1(5)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection’s
decision. Only the Swedish version is authentic.
Swedish ref.:
DI-2021-10188
German SA ref.:
LSA-1085.1-58/20-F
Final decision pursuant to
IMI case register:
investigation under the General Data
164557
Protection Regulation – Klarna Bank
Date of draft decision:
2022-12-15
AB
Date of translation:
2025-06-17
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB has
processed personal data in breach of articles 12(3) and 17 GDPR 1 by not initiating and
complying without undue delay with the complainant’s request for erasure made on 29
November 2019.
IMY finds that tge investigation has not shown that Klarna Bank AB has processed the
complainant’s personal data in breach of Article 21(1) of the GDPR.
IMY issues Klarna Bank AB a reprimand in accordance with Article 58(2)(b) of the
GDPR for violation of of Articles 12(3) and 17 of the GDPR.
Presentation of the supervisory case
IMY has initiated supervision regarding Klarna Bank AB (Klarna or the company) due to
a complaint. The complaint has been submitted to IMY, as competent supervisory
authority for the company’s operations pursuant to Article 56 of the General Data
Protection Regulation (GDPR). The handover has been made from the supervisory
authority of the country where the complainant filed their complaint (the data protection
authority in Bavaria, Germany).
IMY has handled the complaint as the lead supervisory authority, based on the location
Postal address:
Box 8114
of the company’s main establishment (in Stockholm, Sweden) in accordance with Article
104 20 Stockholm 56 of the GDPR. Because of the cross-border nature of the data processing that is
Website:
subject to the complaint, the case has been handled according to the provisions on
www.imy.se cooperation and consistency in Chapter VII of the GDPR. The concerned supervisory
E-mail:
[email protected] 1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority for Privacy National ref: DI-2021-10188 2(5)
Protection
Date:2022-12-15
authorities have been the data protection authorities in Germany, Denmark, Austria,
Italy, Poland and Finland.
The investigation has been carried out through a written procedure.
In the light of the assessments made in the case, in accordance with Article 60(9) of the
GDPR, IMY shall adopt parts of the decision and the supervisory authority of the
complainant, i.e. the data protection authority of Bavaria, Germany, shall adopt the
remaining parts. The facts and assessments in the case have therefore been and
adopted in separate decisions.
What the complainant has stated
The complainant has stated that on 29 November 2019 he made a request for erasure
of his personal data in accordance with Article 17 of the GDPR, without success. The
request was preceded by Klarna providing information about the complainant to a debt
collection company, to which the complainant had not given his consent. After the debt
relationship was settled, the complainant did not receive any further information or
confirmation from Klarna regarding his request.
The complainant has also requested information on recipients under Article 19.
Finally, the complainant has objected to the use of his personal data under Article 21 of
the GDPR.
What Klarna has stated
Klarna has stated the following. Klarna is the data controller for the processing to
which the complaint relates.
Klarna confirms that they have received the complainant’s request for erasure under
Article 17 of the GDPR, that the process of erasing his personal data began on 23
January 2020 and that the complainant was informed of the measures taken. However,
the request for erasure has not been completed due to an individual mistake by an
employee in violation of Klarna’s routines. The employee has received additional
education to ensure that the mistake is not repeated. The process has not been
completed due to the fact that the complainant has continued to use Klarna’s services
beyond July 2020. Due to the existence of additional economical claims and open
customer service cases between Klarna and the complainant, and the complainant’s
continued use of Klarna’s service, his request for erasure has subsequently not been
possible to comply with.
Finally, Klarna states that on 29 November 2019, the company has received the
complainant’s objection to the processing of personal data. The complainant had at that
time a non-regulated debt due to Klarna. On account of the debt, Klarna handed the
complainant’s telephone number to a debt collection company in order to recover the
debt. Klarna states that, at the time of the request, there was no reason to satisfy the
complainant’s objection to the processing of personal data in relation to the debt
collection company. Klarna argues that the balancing of interests underlying the
processing of personal data means that Klarna had legitimate interests to process the
complainant’s personal data until the debt has been settled.
Swedish Authority for Privacy National ref: DI-2021-10188 3(5)
Protection
Date:2022-12-15
Motivation for the decision
Applicable provisions, etc.
Pursuant to Article 12(3) of the GDPR, the controller shall upon request provide the data
subject without undue delay and in any event no later than one month after receiving the
request, with information on the measures taken pursuant to Articles 15 to 22. The period
of one month may be extended by a further two months if the request is particularly
complex or the number of requests received is high. If the deadline of one month is
extended, the controller shall notify the individual of the extension. The extension of the
time limit shall be notified within one month of receipt of the request. The controller shall
also state the reasons for the delay.
Pursuant to Article 17(1), the data subject shall have the right to have his or her personal
data erased from the controller without undue delay and the controller shall be obliged
to erase personal data without undue delay where one of the conditions listed in that
Article exists, for example where the data are no longer necessary for the purposes for
which they have been collected or if consent for processing is withdrawn. Article 17(3)
lists the exceptions to this right.
According to article 19 the controller is required to inform each recipient to whom the
personal data have been disclosed of any rectification or erasure of personal data or
restriction of processing carried out in accordance with Articles 16, 17(1) and 18, unless
this proves impossible or involves a disproportionate effort. The controller shall inform
the data subject of these recipients at the request of the data subject.
Under Article 21(1), the individual shall have the right, on grounds relating to his or her
specific situation, to object at any time to processing of personal data concerning him or
her based on Article 6(1)(e) (information in the public interest or the exercise of official
authority) or (f) (legitimate interest), including profiling based on those provisions. The
controller shall no longer process the personal data unless they can demonstrate
compelling legitimate interests for the processing which override the interests, rights and
freedoms of the individual, or for the establishment, exercise or defence of legal claims.
IMY’s assessment
IMY has initiated supervision in order to investigate whether Klarna has handled the
complainant’s requests for erasure of his personal data in accordance with the
provisions of the GDPR.
Has there been a breach of Articles 12(3) and 17 of the GDPR?
IMY notes that Klarna received the complainant's erasure request on 29 November
2019. Klarna has stated that it did not initiate the deletion process until 23 January 2020,
after which the request was not completed due to an individual mistake by an employee
and in breach of Klarna's procedures. It is IMY’s understanding that Klarna recognises
that a deletion should have been done, but was not completed due to the employee's
mistake. In light of the above, the complainant's request has neither been initiated nor
completed without undue delay and within the stipulated time limit in Article 12(3). The
complainant has also not been informed of the delay.
IMY has no reason to question Klarna's statement that, after having submitted a request
for erasure, the complainant started using Klarna's services again as of June 2020 and
thus provided Klarna with additional personal data. This processing of the complainant's
Swedish Authority for Privacy National ref: DI-2021-10188 4(5)
Protection
Date:2022-12-15
personal data, which took place when seven months had passed after his request for
erasure, is in IMY’s view not covered by the request for erasure made on 29 November
2019. IMY therefore does not consider that Klarna, by not erasing the complainant's
personal data due to ongoing processing after July 2020, has failed to comply with the
GDPR. However, as stated above, IMY notes that the complainant’s request from 29
November 2019 to July 2020 has not been fulfilled without delay.
IMY finds that Klarna has processed the complainant’s personal data in breach of Article
12(3) and 17 of the General Data Protection Regulation by not initiating and complying
with the complainant’s request for erasure made on 29 November 2020 without undue
delay. No erasure of the complainant’s personal data has taken place. Since Article 19
of the GDPR is aimed at when erasure has been completed, the article is not applicable
in this case.
Has there been a breach of Article 21(1) GDPR?
As the complaint shows, the complainant was contacted by a debt collection company
which had received the complainant’s telephone number from Klarna. The complainant
has objected to the processing of his personal data including profiling pursuant to Article
21(1) GDPR. The right to object relates to ongoing processing of personal data. IMY
perceives that the complainant’s objection relates to the processing of personal data
carried out on an ongoing basis, through Klarna’s transfer of the complainant’s data to
a debt collection company which was still ongoing at the time of the objection.
Klarna states that the complainant had a debt which had not been settled. The debt has
thus been handed over to the debt collection company for continued management of the
overdue debt. The information contained in the complaint does not contradict the
existence of a debt relationship. Klarna has processed the complainant’s personal data
by handing over the complainant’s telephone number to the debt collection company
until the debt is settled. IMY considers that Klarna’s interest in taking action to recover
outstanding claims weighs heavily. In addition, IMY considers that the contact details of
the debtor, such as telephone number or address, constitute information that is relevant
and adequate to handle in the context of a recovery procedure, including, for the purpose
of obtaining payment settlements. Overall, IMY assesses that Klarna, by submitting the
data in question to the debt collection company for settlement of the debt, had
compelling legitimate interests to process the complainant’s personal data as referred
to in Article 21(1) of the GDPR, which outweighs the complainant’s right to object to the
processing of personal data. Klarna was therefore entitled not to take into account the
request for objection to the processing of personal data received.
Against this background, IMY notes that Klarna does not fail to comply with Article 21(1)
GDPR.
Choice of corrective measure
According to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to or in place of the other
measures referred to in Article 58(2), such as injunctions and prohibitions. Furthermore,
Article 83(2) provides which factors are to be taken into account when deciding on
administrative fines and in determining the amount of the fine.
In the case of a minor infringement, as stated in recital 148, IMY may, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Factors to consider is
Swedish Authority for Privacy National ref: DI-2021-10188 5(5)
Protection
Date:2022-12-15
the aggravating and mitigating circumstances of the case, such as the nature, gravity
and duration of the infringement and past relevant infringements.
IMY notes that Klarna started the erasure and that it was not completed due to a mistake
made by an individual employee in violation of the company’s routines. The employee
has been trained to ensure that this error is not repeated. It is a data subject and neither
sensitive nor privacy-sensitive data in this case. Because of these circumstances, IMY
considers that this is a minor infringement within the meaning of recital 148 and Klarna
Bank AB should be given a reprimand under Article 58(2)(b) of the GDPR for the
infringements found.
This decision has been approved by the specially appointed decision-maker
after presentation by legal advisor .
Copy to
Data protection officer