1(4)
Our ref.:
DI-2020-10518, IMI case no Supervision under the General Data
134712
Protection Regulation – Klarna Bank
Date:
2021-03-31 AB
Final decision of the Swedish Authority for
Privacy Protection
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has violated
Article 12(3) GDPR1 by
regarding complaint 1: not without undue delay respond to a request of
access pursuant to article 15.
The Swedish Authority for Privacy Protection gives Klarna Bank AB a reprimand in
accordance with Article 58(2)(b) of the General Data Protection Regulation.
Description of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (the company) due to two complaints. Each complaints have been
submitted to IMY, as responsible supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation, from the supervisory
authority of the country where the complainants have lodged their complaint (Austria
and Germany) in accordance with the Regulation’s provisions on cooperation in cross-
border matters.
The complainants have stated that they have requested access to their personal data
in accordance with Article 15 of the General Data Protection Regulation. Due to the
complaints, IMY has initiated supervision to investigate whether the complainants’
requests for access under Article 15 have been met and whether it has been made
within the specified time limit in Article 12(3).
Postal address:
Box 8114
104 20 Stockholm
Klarna Bank AB states that they are the controller for the processing of personal data
Sweden that the complaints concern. The company also states that they handle a large amount
Website:
GDPR related requests.
www.imy.se
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the
Telephone: processing of personal data and on the free flow of such data and repealing Directive 95/46/EC
+46 (8) 657 61 00 (General Data Protection Regulation).
Swedish Authority Our ref.: DI-2020-10518, IMI case no 134712 2(4)
for Privacy Protection Date: 2021-03-31
Complaint 1 (from Austria with national reference number: D130.247)
Regarding the first complaint, the company states that the complainant’s request for
access was received by the company via e-mail on 5, 10 and 29 January 2019. Since
the request was received to a different email address than the one referred to by the
company for data protection issues, the request was not processed in accordance with
the company’s internal processing procedures. This led to a longer processing time
and that information and a copy of the complainant’s personal data according to Article
15 were not sent until 18 June 2019. The company also states that they have promptly
answered the complainant’s follow-up questions regarding the company’s personal
data processing, which the complainant has been satisfied with.
Complain 2 (from Germany with national reference number: LDA-1085.1-13373/19-F)
Regarding the second complaint, the company states that the complainant’s request
for access was received to the company’s chat on 28 October 2019. The complainant
repeated their request by e-mail on 30 October 2019. The company contacted the
complainant on 6 November 2019 to request additional information. These were
provided the same day. On 11 November 2019 the company sent out information and
a copy of the personal data to the complainant pursuant to Article 15, i.e. within 14
days of receiving the request. On 14 November 2019, the company sent more detailed
information about the company’s automated decision-making on purchases. The
complainant contacted the company again on 13 December 2019 due to the fact that
they had not received the company’s mailings. The company requested a new address
on 7 January 2020 and has not received a reply.
The investigation has been carried out in written form. In light of it being two cross-
border complaints, IMY has used the mechanisms for cooperation and consistency
contained in Chapter VII of the General Data Protection Regulation. The supervisory
authorities concerned have been the data protection authorities in Austria, Germany,
the Czech Republic, Denmark and Norway.
Justification of decisions
Applicable provisions
To anyone who requests a data controller is obliged to provide information about
whether or not their personal data is being processed. If such data is processed, the
controller shall, in accordance with Article 15 of the General Data Protection
Regulation, provide the applicant with supplementary information and a copy of the
personal data processed by the controller.
According to Article 12(3), a request for access must be handled without undue delay
and in any event no later than one month after the request has been received. The
time limit of one month may be extended by an additional two months if the request is
particularly complicated or the number of requests received is high.
If the period of one month is extended, the controller must notify the data subject of the
extension. The notification of the extension of the time limit shall take place within one
month of receipt of the request. The controller must also specify the reasons for the
delay.
Swedish Authority Our ref.: DI-2020-10518, IMI case no 134712 3(4)
for Privacy Protection Date: 2021-03-31
According to Article 12(6), the controller may request, if he or she has reasonable
reason to doubt the identity of the natural person who submits a request pursuant to
Article 15, that additional information necessary to confirm the identity of the data
subject may be provided.
The Swedish Authority for Privacy Protection’s assessment
Has there been an infringement of the GDPR?
Complaint 1 (from Austria with national reference number: D130.247)
Regarding the first complaint IMY states that the complainant has been provided with
information and a copy of the personal data being processed pursuant to Article 15 of
the General Data Protection Regulation. However, the right to access was only
granted after more than five months from the date the first request was submitted. The
request has therefore not been handled without undue delay and within the stipulated
time limit in Article 12(3). The complainant has also not been informed of the delay.
What the company has stated about handling a large number of requests under the
General Data Protection Regulation and the fact that fallow up questions have been
answered quickly does not lead to any other assessment concerning the delay and
thus the infringement of article 12(3) in one case.
Complain 2 (from Germany with national reference number: LDA-1085.1-13373/19-F)
Regarding the second complaint IMY states that the complainant has been provided
with information and a copy of the personal data pursuant to Article 15. The
information was provided without undue delay. After the complainant pointed out that
they had not received the mailing, the company requested alternative contact details.
Against this background, IMY considers that the company has not been obliged to take
any further action on the basis of that request.
Choice of corrective measure
Pursuant to Article 58(2)(i) and Article 83(2) the IMY has the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the individual case, administrative fines may be imposed in addition to or instead of the
other measures referred to in Article 58(2). Furthermore, Article 83(2) states which
factors should be taken into account in decisions on whether administrative fines
should be imposed and when determining the amount of the fine. In case of a minor
infringement, IMY may, as stated in Recital 148, instead of imposing a sanction fee,
issue a reprimand pursuant to Article 58(2)(b). In this assessment, regard shall be
taken to aggravating and mitigating circumstances in the case, such as the nature of
the infringement, severity and duration as well as previous infringement of relevance.
In an overall assessment of the circumstances IMY considers that it is a matter of a
minor infringement, regarding complaint 1, and that Klarna Bank AB should therefore
be given a reprimand pursuant to Article 58(2)(b) for the stated infringement.
This decision has been made by Head of Unit after presentation
by legal advisor .
Swedish Authority Our ref.: DI-2020-10518, IMI case no 134712 4(4)
for Privacy Protection Date: 2021-03-31
Notice. This document is an unofficial translation of the Swedish Authority for Privacy
Protection’s (IMY) decision 2021-03-31, no. DI-2020-10518. Only the Swedish version
of the decision is deemed authentic.