1(4)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY)
decision, no. DI-2021-10665. Only the Swedish version of
the decision is deemed authentic.
Registration number:
DI-2021-10665, IMI case no. Decision under the General Data
351839,
521.15317_631.464 Protection Regulation – Klarna Bank
AB
Date of decision:
2022-06-14
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has processed
personal data in breach of Article 12(3) of the GDPR1 by not informing the complainant
without undue delay of the outcome of the complainant’s request for erasure pursuant
to Article 17 of 15 October 2021 only on 18 November 2021.
The Swedish Authority for Privacy Protection issues Klarna Bank AB a reprimand
pursuant to Article 58(2)(b) GDPR for infringement of Article 12(3) of the GDPR.
Report on the supervisory case
The case handling
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (Klarna or the company) due to a complaint. The complaint has been
submitted to IMY, in its capacity as lead supervisory authority under Article 56 of the
General Data Protection Regulation (GDPR). The handover has been made by the
supervisory authority of the country where the complainant has lodged their complaint
(Germany) in accordance with the Regulation’s provisions on cooperation concerning
cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since the complaint relates to cross-border processing, IMY has used the mechanisms
for cooperation and consistency contained in Chapter VII GDPR. The supervisory
authorities concerned have been the data protection authorities in Denmark, Finland,
Italy, Poland, Germany and Austria.
Mailing address:
Box 8114
104 20 Stockholm
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Registration number: DI-2021-10665 2(4)
Date: 2022-06-14
The complaint
The complainant mainly states the following. A request for erasure was made to Klarna
on 15 October 2021 and the complainant had not received any response from Klarna
as of 16 November 2021.
What Klarna has stated
Klarna mainly states the following.
Klarna is the data controller for the processing to which the complaint relates.
Klarna received the request for erasure on 15 October 2021. Klarna initiated the
erasure of the complainant’s personal data on 29 October 2021 and completed it on 15
November 2021. Confirmation on the erasure of the complainant’s personal data was
sent to the complainant on 18 November 2021.
According to Klarna’s internal procedures, a confirmation on the initiation of personal
data erasure should be sent to the person requesting erasure by e-mail as soon as the
erasure process is initiated, in this case on 29 October 2021. In the present case, no
such confirmation e-mail was sent until the 18 November 2021. However, this has not
affected the actual deletion of the complainant’s personal data.
Justification of the decision
Applicable provisions
Article 17(1)(a) states that the data subject shall have the right to obtain from the
controller the erasure of personal data concerning him or her without undue delay and
the controller shall have the obligation to erase personal data without undue delay, if
the personal data are no longer necessary in relation to the purposes for which they
were collected or otherwise processed. Article 17(3) lists all exceptions to this right.
Article 12(3) of the GDPR requires the controller to provide information on action taken
on a request under, inter alia Article 17, without undue delay and in any event within
one month of receipt of the request. This period may be extended by a further two
months where necessary, taking into account the complexity and number of requests.
The controller shall inform the data subject of such extension within one month of
receipt of the request, together with the reasons for the delay.
IMY:s assessment
Klarna states that the complainant’s request for deletion was received by Klarna on 15
October 2021 and that the data had been deleted on 15 November 2021. IMY finds no
reason to call this into question. IMY therefore considers that the request for erasure
has been carried out without undue delay.
Article 12(3) also imposes an obligation for the controller to provide information on the
action taken in response to the request. Such information shall be provided without
undue delay and in any event no later than one month after the controller receives the
request.
Klarna informed the complainant on 18 November 2021, i.e. three days later than one
month after Klarna had received the request. Although the time frame of one month
may be extended under certain circumstances in accordance with Article 12(3), it is
Privacy Protection Authority Registration number: DI-2021-10665 3(4)
Date: 2022-06-14
required that the controller notifies the data subject of such a delay and the reason for
the delay within one month from when they received the request. It has not been
established that Klarna provided the complainant such notification. IMY therefore finds
that Klarna has processed personal data in breach of Article 12(3) by not informing the
complainant of the outcome of their request for erasure without undue delay.
Choice of intervention
Article 58(2) and Article 83(2) of the GDPR gives IMY the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to, or in place of the other
measures referred to in Article 58(2), such as warnings and prohibitions. Furthermore,
it is clear from Article 83(2) which factors are to be taken into account when deciding
whether to impose administrative fines and in determining the amount of the fine. In
the case of a minor infringement, as stated in recital 148, IMY may issue a reprimand
pursuant to Article 58(2)(b) instead of imposing a fine. Considering the aggravating
and mitigating circumstances of the case, such as the nature, gravity and duration of
the infringement and past relevant infringements.
IMY notes the following relevant facts. The infringement has affected one person,
lasted a relatively short period of time and occurred as a result of a mistake. In light of
this, IMY considers that this is a minor infringement within the meaning of recital 148
which means that Klarna Bank AB shall be given a reprimand under Article 58(2)(b) of
the GDPR for the infringement.
___________________________________________________
This decision has been approved by the specially appointed decision-maker, legal
advisor following a presentation by legal advisor
Privacy Protection Authority Registration number: DI-2021-10665 4(4)
Date: 2022-06-14
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection. Please indicate in your letter the decision you want to appeal and
the amendment that you are requesting. The appeal must reach the Swedish Authority
for Privacy Protection no later than three weeks from the date on which you received
the decision. If the appeal has been received in due time, the Swedish Authority for
Privacy Protection will forward it to the Administrative Court in Stockholm for review.
You can send the appeal by e-mail to IMY if the appeal does not contain any sensitive
personal data or information that may be subject to confidentiality. The Swedish
Authority for Privacy Protection’s contact details are set out in the first page of the
decision.