1(4)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY) decision
2021-12-06, no. DI-2021-2135. Only the Swedish version of
the decision is deemed authentic.
Ref no:
DI-2021-2135, IMI no. 134681 Supervision under the General Data
Date of decision: Protection Regulation – Klarna Bank
2021-12-06
AB
Date of translation:
2021-12-07
Final decision of the Swedish Authority for
Privacy Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that the investigation has not
shown that Klarna Bank AB has processed the complainant’s personal data in violation
of Article 12(3), 12(4) and 17(1) of the General Data Protection Regulation (GDPR)1.
The case is closed.
Report on the supervisory report
The case handling
The Swedish Authority for Privacy Protection (IMY) has initiated supervision of Klarna
Bank AB (Klarna or the company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as responsible supervisory authority pursuant to
Article 56 of the GDPR. The handover has been made from the supervisory authority
of the country where the complainant has lodged the complaint (Norway) in
accordance with the Regulation’s provisions on cooperation concerning cross-border
processing.
The investigation at IMY has been carried out in written form. In the light of cross-
border processing, IMY has used the mechanisms for cooperation and consistency
contained in Chapter VII of the GDPR. The supervisory authorities concerned have
been the data protection authorities in Norway, Denmark, Finland, Germany and Italy.
The complaint (national reference number: 20/00017)
The complaint is essentially the following. The complainant cancelled an order in which
Klarna was used as a payment option. The complaint then requested that the company
Postal address:
Box 8114 erase his information. The company accepted the request, but stated that it could take
104 20 Stockholm up to 90 days before the data has been deleted. The complainant questions whether it
Website: is a reasonable time to handle a request.
www.imy.se
E-mail:
[email protected]
1Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with respect to the processing of
Phone: personal data and on the free flow of such data and repealing Directive 95/46/EC (General Data Protection
08-657 61 00 Regulation).
Privacy Protection Authority Our ref: DI-2021-2135, IMI no. 134681 2(4)
Date:2021-12-06
What Klarna PUA has stated
Klarna as mainly stated the following.
Klarna is the data controller for the processing concerned in the the complaint.
The request was submitted to Klarna on 17 December 2019. Klarna has handled the
request for deletion and fully met the request. Initial measures were taken on 19
December 2019. That entails that the complaint was blocked from receiving further
mailings from Klarna, the so-called automatic entry of data was blocked, the complaint
was blocked from logging into the Klarna app and adding the complainant to the next
round of deletion that is regularly distributed to the relevant system owners who
perform the deletion of personal data. On 14 February 2020, the complainant’s
personal data had been erased from all systems subject to the right to be erased. It
should be added that the complainant has used Klarna’s services even after the
request for deletion was received and carried out.The processing of personal data for
this reason has not been covered by the current request to be erased.
The complainant was informed by email on 18 December 2019 that the request had
been received and that the process for being deleted has been initiated and the
longest time a deletion can take. In this context, Klarna wishes to clarify that Klarna
also has a process in which all customers who make a request or otherwise indicate
that they want to be notified that the deletion has been carried out will receive a
confirmation when the deletion is complete. If no such request is made, no such
confirmation will be sent. The background to this process is that such a mailing itself
involves additional processing of personal data. Klarna’s assessment is that most
customers who request to be erased wish to minimise Klarna’s personal data
processing of their data. In the case in question, the complainant has not made a
request to be notified when the deletion has been carried out, so he has not been
notified of it. However, as stated above, the complainant has been notified that the
process has been initiated and at which time the data will be deleted at the latest.
Klarna holds that it has handled the request without undue delay due to the following.
During the period of 1 November 2019 to 31 December 2019, 753 requests for
deletion were received to Klarna, i.e. more than 18 per working day. During the period
thereafter, 1 January 2020 to 29 February 2020 received 2281 requests for deletion to
Klarna, i.e. more than 55 per working day. For each individual request, it is verified that
the right person has submitted the request as well as what other internal controls and
initial measures are necessary in relation to each individual request. Exactly what
measures need to be taken must be assessed based on the legal and regulatory
requirements that apply to Klarna’s operations, and based on each individual case
since Klarna’s customers often have a variety of engagements with Klarna. To ensure
that all personal data subject to the right to be erased is also deleted, each request is
distributed after these initial actions to the teams within Klarna that process data on
data subjects. These teams also perform the deletion themselves in each case. Once
the deletion is completed, it is reported to the centrally responsible team.
As stated above, Klarna received the request for deletion from the complainant on 17
December 2019. The next two days all initial actions were taken and the complainant
was informed that the process for deletion had begun and that the process could take
up to 90 days. Subsequently, the teams concerned have taken over to carry out the
actual deletion. As stated above, during the current period, Klarna handled a very large
number of requests for deletion. As stated above, all such requests must be handled
Privacy Protection Authority Our ref: DI-2021-2135, IMI no. 134681 3(4)
Date:2021-12-06
carefully in order to ensure correct handling where in each individual case an
assessment of which data is covered by the right to be erased. The last report on
actual deletion took place in the case in question on 14 February 2020.
Against this background, Klarna believes that the request has been handled in
accordance with the requirements of the GDPR. In particular, Klarna has provided the
complainant with information about the measures taken without undue delay, namely
within two days.
Klarna is continuously working to improve, simplify and streamline this and other
processes to ensure data subjects’ rights under the GDPR. Not only to deal with these
legal, but also to create clarity and simplicity for data subjects. The ongoing
improvement takes place in the light of feedback from the company’s customers,
published guidelines from authorities and own initiatives. The processing time as of
March 2021 is therefore shorter than it was at the time of the request.
Justification of the decision
Applicable provisions
According to Article 12(3) of the GDPR, the controller shall, upon request, without
undue delay and, in any event, no later than one month after receiving the request,
provide the data subject with information on the measures taken pursuant to, inter alia,
Article 17. The deadline of one month may be extended by an additional two months if
the request is particularly complicated or the number of requests received is high. If
the period of one month is extended, the controller must notify the data subject of the
extension. The notification of the extension of the deadline shall take place within one
month of receipt of the request. The controller must also indicate the reasons for the
delay.
According to Article 12(4), the controller shall inform the data subject if he does not
take action on the data subject’s request without delay, and no later than one month
after receiving the request, inform the data subject of the reason why measures have
not been taken and of the possibility of filing a complaint with a supervisory authority
and requesting judicial review.
According to Article 17(1)(a), the data subject shall have the right to have their
personal data erased by the controller without undue delay and the controller shall be
obliged to erase personal data without undue delay if it is no longer necessary for the
purposes for which they were collected or otherwise processed. Article 17(3) contains
an exhaustive enumeration of the exceptions to this right.
Assessment of the Authority for Privacy Protection (IMY)
The investigation shows that the complainant’s request for deletion was received by
Klarna on 17 December 2019 and had been fulfilled on 14 February 2020, i.e. just
under two months after it was received. According to Klarna, the request has been fully
complied with, which IMY does not find reason to question.
Also shown is the fact that Klarna sent a notification to the complaint two days after the
request was received. In it Klarna informed that the erasure had been initiated and
could take up to 90 days. IMY finds that Klarna thereby has given such notice as is
Privacy Protection Authority Our ref: DI-2021-2135, IMI no. 134681 4(4)
Date:2021-12-06
required under Article 12(3) when extending the maximum deadline of one month to
handle a request when a data subject to exercise his or her rights.
Furthermore, the investigation shows that Klarna did not inform the complainant that
the erasure had been carried out after it had been carried. Klarna holds that the initial
erasure notification before the erasure is carried out – which confirms that the request
has been granted, that erasure has been initiated and how long it will take at the
longest – is sufficient unless the data subject requests otherwise or otherwise
indicated that he or she wants to be notified that the erasure has been carried out. This
is because Klarna considers that most of Klarna’s customers who request erasure
want to minimize Klarna’s processing of their personal data. IMY considers that such
handling is compatible with Article 12(3), provide that the stated time in which the
erasure is supposed to have been carried out is reasonable, the data subject is
informed of the possibility of obtaining confirmation of the erasure, and that the data
subject is notified if the erasure is not carried out within the stated time. IMY finds that
it has not arisen reason to question Klarna’s handling in this case.
The last question is therefore whether the request has been handled without undue
delay. In light of what Klarna has stated about the large number of requests received
during the period in question, the checks that must be made specifically due to the
regulatory requirements arising from Klarna’s banking activities and the number of
systems from which the data should be erased from, IMY finds that Klarna has
handled the request without undue delay in the sense referred to in Article 12(3) and
17(1).
Against this background, IMY finds that the investigation has not shown that Klarna
Bank AB has processed the complainant’s personal data in violation of Article 12(3),
12(4) and 17(1) of the General Data Protection Regulation.
The case is closed.
The specially appointed decision-maker has made this decision after
presentation by legal advisor .