1(6)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY)
decision, no. DI-2021-10448. Only the Swedish version of
the decision is deemed authentic.
Registration number:
DI-2021-10448, IMI case no. Decision under the General Data
350245,
83.41/20.039 Protection Regulation – Klarna Bank
AB
Date of decision:
2022-06-14
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has processed
personal data in breach of Article 15 of the GDPR1 by not giving the complainant
access to his personal data without undue delay, according to the request of 15
October 2020, until 21 January 2022.
The Swedish Authority for Privacy Protection issues Klarna Bank AB a reprimand
pursuant to Article 58(2)(b) GDPR for violation of Article 15.
Report on the supervisory case
The case handling
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (Klarna or the company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as lead supervisory authority under Article 56 of the
GDPR. The handover has been made by the supervisory authority of the country
where the complainant has lodged their complaint (Germany) in accordance with the
GDPR’s provisions on cooperation concerning cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since this is a complaint relating to cross-border processing, IMY has used the
mechanisms for cooperation and consistency contained in Chapter VII GDPR. The
supervisory authorities concerned has been the data protection authorities in
Denmark, Finland, Germany, France, Norway and the Netherlands.
The complaint
Mailing address:
Box 8114 The complaint mainly states the following.
104 20 Stockholm
Website: The complainant used Klarna’s services for an internet purchase several years ago.
www.imy.se The complainant’s partner then received bills which in some cases were addressed to
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Registration number: DI-2021-10448 2(6)
Date: 2022-06-14
the complainant. In December 2018, the complainant requested Klarna to correct the
names in the e-mails. Klarna’s services were not used again until 2020 by the
complainant’s partner, after which the complainant’s partner once again received e-
mails from Klarna with the complainant’s name. The complainant subsequently made a
request for rectification. The complainant also submitted a request for access on 15
October 2020 but received no reply from Klarna.
What Klarna has stated
Klarna Bank AB mainly states the following.
Klarna is the data controller for the processing to which the complaint relates.
Klarna notes that the complainant has made three purchases in 2017 and 2018 and
paid through Klarna. Those purchases included information about the complainant’s
first name, surname and postal address, as well as an e-mail address containing the
complainant’s name. In 2018, a further five purchases were made in which the
complainant’s first name, surname and postal address were entered. On these
purchases, another e-mail address was entered, hereinafter referred to as “e-mail
address Y”.
Klarna notes that the complainant’s partner lives at the same postal address as the
complainant. The complainant’s partner has also paid with Klarna on several
occasions and has entered “e-mail address Y” for each purchase. Klarna suspects that
the email address in question belongs to the complainant’s partner because it contains
the partner’s name.
For each purchase, Klarna evaluated the identity of the complainant on the basis of the
information provided at the time of purchase, i.e. first name, surname and postal
address, by validating the data with the support of Deutsche Post AG. However, e-mail
addresses are not part of the validation as it is not a data point available to Deutsche
Post AG. Deutsche Post AG has thus verified that the first and last names of the
complainant are registered at the provided postal address, which is also the address to
which the purchased goods have been sent. Digital communication about purchases
and debts is sent to the e-mail address provided by the customer.
Regarding the five purchases in 2018, the orders have been made with the
complainant’s first name, surname, postal address and “e-mail address Y”. This is
information that has been submitted to Klarna in connection with the purchases. This
can be done by entering the complainant’s name at the merchant’s login portal and
saved with the merchant as part of the customer’s profile. The information is then
automatically sent to Klarna when the customer is logged in with the merchant and
places an order. This can also be done if the data has been entered manually in a free
text field in the merchant’s checkout provided by Klarna. This handling is outside
Klarna’s control and the company has no access to any information about this. Klarna
can only state that the information has been sent to Klarna in one of the ways above.
For all five purchases in 2018, for which the complainant has claimed that the
complainant’s partner made the purchases, the complainant’s first name, surname and
postal address have been entered together with “e-mail address Y”. As a result, the
first e-mail sent to “email address Y” has included the complainant’s name. In the
context of a subsequent sixth purchase on 31 August 2020, the information that Klarna
had previously linked to “email address Y” was used to generate a first name in an e-
Privacy Protection Authority Registration number: DI-2021-10448 3(6)
Date: 2022-06-14
mail of 22 September 2020 using the complainant’s first name in the introductory
greeting. No personal data other than the complainant’s first name were sent out.
Klarna has had extensive contact with the complainant on a number of subjects. As
can be seen from the notes that Klarna still retains, the complainant has requested that
information be rectified on two occasions, on 5 November 2018 and on 10 October
2020. Klarna has rectified all the information which the complainant has requested to
be corrected.
In examining the case, Klarna also understood that the complainant and their partner
used each other’s personal data for purchases carried out in 2018, which were not
covered by the complainant’s requests for rectification. Klarna has been able to
conclude from the review that the name for individual historical purchases has had to
be updated.
Klarna has received a request for access on 15 October 2020. In the light of previous
extensive contacts with the complainant and the request for rectification already
pending since 10 October 2020, the individual case handler did not draw attention to
the fact that the request of 15 October 2020 related to a different right. The case
handler was under the impression that the complainant’s request for access would be
handled in the context of the pre-existing case.
The correct procedure under Klarna’s internal routines would have been to initiate an
additional case concerning the request for access. Klarna observes that, as a result of
that individual error, the complainant’s request was not handled within the time limit.
Following IMY’s audit, Klarna has carefully analysed the case, drawing attention to the
request for access and fulfilling it on 21 January 2022.
Justification of the decision
Applicable provisions
According to Article 4(1) of the GDPR, the term ‘personal data’ carries broad meaning.
Personal data are any information relating to an identified or identifiable natural person
(a data subject). A data subject can be identified both directly and indirectly by a range
of possible identifiers, which the article contains a non-exhaustive list of, including
names.
Article 5(1)(d) of the GDPR requires the controller to ensure that personal data is
processed is accurate (principle of accuracy). If necessary, the personal data shall
also be kept up to date. The controller must of its own volition take every reasonable
step to ensure that personal data that are inaccurate, having regard to the purposes
for which they are processed, are erased or rectified without delay.
Pursuant to Article 15 of the GDPR, the data subject shall have the right to obtain from
the controller confirmation as to whether or not personal data concerning him or her
are being processed. If such personal data are processed, the controller shall provide
the data subject with additional information and a copy of the personal data processed
by the controller.
Pursuant to Article 16 of the GDPR, the data subject shall have the right to obtain from
the controller without undue delay the rectification of inaccurate personal data
concerning him or her. Taking into account the purposes of the processing, the data
Privacy Protection Authority Registration number: DI-2021-10448 4(6)
Date: 2022-06-14
subject shall have the right to have incomplete personal data completed, including by
means of providing a supplementary statement.
Article 12(3) of the GDPR requires the controller to provide information on action taken
on a request under, inter alia Article 15, without undue delay and in any event within
one month of receipt of the request. This period may be extended by a further two
months where necessary, taking into account the complexity and number of requests.
The controller shall inform the data subject of such extension within one month of
receipt of the request, together with the reasons for the delay.
Assessment by the Integrity Protection Authority
Has there been a breach of Article 5 of the GDPR?
The complaint states that Klarna has regularly confused the personal data of the
complainant and their partner by addressing several e-mails to the wrong recipient.
Among other things, Klarna has stated that they have a system for automatic
generation of first names in the initial greeting of e-mails. Both the complainant and
their partner have used the same e-mail address, i.e. “e-mail address Y”. The
complainant’s partner has previously placed orders with their corresponding personal
data and “e-mail address Y”. In connection with a sixth purchase in 2020, Klarna has
used the latest known information about “e-mail address Y”, which resulted in the
complainant’s first name being generated in an initial greeting in the e-mail message.
IMY has found no reason to question Klarna’s information in this regard.
IMY therefore notes that “e-mail address Y” has been used by both the complainant
and the complainant’s partner to pay through Klarna. Although IMY considers it
important that a correct first name is used when a data controller contacts a data
subject, “email address Y” has been used by both the complainant and their partner to
place orders through Klarna in the present case. No other personal data than the
complainant’s first name has been entered in the e-mail message to their partner, and
it also appears that the complainant’s first name is relatively common. The name in
question does therefore not constitute an identifier specific to the complainant.
Moreover, Klarna has of its own volition rectified information attributable to the
complainant, which was not covered by any of the complainant’s requests.
Against this background, IMY notes that the investigation does not show that Klarna
Bank AB fails to comply with Article 5(1)(d) GDPR in the matter that is subject to
supervision in the present case.
Has there been a breach of Article 16 of the GDPR?
Klarna states that they have received two requests for rectification from the
complainant on 5 November 2018 and 10 October 2020. Klarna has stated that it has
rectified all the information per the complainant’s requests without undue delay. The
complainant has not claimed that their requests for rectification were not met to any
extent. IMY therefore finds no reason to question Klarna’s information in this regard.
IMY therefore concludes that the investigation shows that Klarna Bank AB does not fail
tocomply with Article 16 of the GDPR in the matter that is subject to supervision in the
present case.
Privacy Protection Authority Registration number: DI-2021-10448 5(6)
Date: 2022-06-14
Has there been a breach of Article 15 of the GDPR?
Klarna has stated that they received a request for access on 15 October 2020. Due to
an error, the company did not recognize the request at that time. The request was
brought to Klarna’s attention after IMY initiated its audit and was therefore only
completed on 21 January 2022, i.e. approximately one year and three months after the
request was made.
A request for access shall be handled with without undue delay, but no later than
within one month from when the controller received the request. The deadline of one
month may be extended by a further two months under the conditions set out in Article
12.3 GDPR. Considering Klarna fulfilled the complainant’s request for access more
than one year after the request was made, it is clear that Klarna under no
circumstances handled the complainant’s request within any of the deadlines set out in
the GDPR. Klarna’s explanation to the reason for the delay being an oversight by a
case handler does not change IMY:s assessment. Therefore, Klarna did not handle the
complainant’s request for access of 15 October 2020 without undue delay.
IMY therefore concludes that Klarna Bank AB has infringed Article 15 GDPR by not
giving the complainant access to their personal data without undue delay, according to
their request of 15 October 2020, until 21 January 2022.
Choice of intervention
Article 58(2) and Article 83(2) of the GDPR gives IMY the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to or in place of the other
measures referred to in Article 58(2), such as warnings and prohibitions. Furthermore,
it is clear from Article 83(2) which factors are to be taken into account when deciding
whether to impose administrative fines and in determining the amount of the fine. In
the case of a minor infringement, as stated in recital 148, IMY may issue a reprimand
pursuant to Article 58(2)(b) instead of imposing a fine. Considering the aggravating
and mitigating circumstances of the case, such as the nature, gravity and duration of
the infringement and past relevant infringements.
IMY notes the following relevant facts. Klarna has infringed Article 15 of the GDPR by
not handling the complainant’s request for access without undue delay. The time that
has elapsed since the request for access was made is relatively long. As is made clear
by the supporting documents, the complainant has made several requests, including a
request for rectification on 10 October 2020 and a request for access on 15 October
2020, after which a case handled at Klarna had not understood that they were different
rights. It is therefore a mistake. In light of this, IMY considers that this is a minor
infringement within the meaning of recital 148 which means that Klarna Bank AB shall
be given a reprimand under Article 58(2)(b) of the GDPR for the infringement.
___________________________________________________
This decision has been taken by the specially appointed decision-maker, legal advisor
following a presentation by
Privacy Protection Authority Registration number: DI-2021-10448 6(6)
Date: 2022-06-14
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection. Please indicate in your letter the decision you want to appeal and
the amendment that you are requesting. The appeal must reach the Swedish Authority
for Privacy Protection no later than three weeks from the date on which you received
the decision. If the appeal has been received in due time, the Swedish Authority for
Privacy Protection will forward it to the Administrative Court in Stockholm for review.
You can send the appeal by e-mail to IMY if the appeal does not contain any sensitive
personal data or information that may be subject to confidentiality. The Swedish
Authority for Privacy Protection’s contact details are set out in the first page of the
decision.