1(6)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY)
decision, no. DI-2021-10447. Only the Swedish version
of the decision is deemed authentic.
Registration number:
DI-2021-10447 IMI. Case no. Decision under the General Data
134712, 521.14809 / 631.420
Protection Reglation – Klarna Bank
AB
Date of decision:
2022-07-28
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB has
processed data in breach of
• Article 12(2) of the General Data Protection Regulation (GDPR)1 by not facilitating
the exercise of the complainant’s right under Article 17 to have his data deleted in
accordance with its request of 9 May 2021 because Klarna Bank AB’s request for
identification data was not sent out via the contact details provided by the
complainant at the request.
The Swedish Authority for Privacy Protection issues Klarna Bank AB a reprimand
pursuant to Article 58(2)(b) of the GDPR for the infringement of Article 12(2) of the
GDPR.
Report on the supervisory report
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (the company or Klarna) due to a complaint. The complaint has been
submitted to IMY, as responsible supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation (GDPR) from the
supervisory authority in (Germany) where the complainant has lodged their complaint
in accordance with the GDPR’s provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since this is a complaint relating to cross-border processing, IMY has used the
mechanisms for cooperation and consistency contained in Chapter VII GDPR. The
Postal address: supervisory authorities concerned has been the data protection authorities in Austria,
Box 8114 the Czech Republic, Denmark, Estonia, Finland, France, Germany, Hungary, Italy,
104 20 Stockholm Ireland, the Netherlands, Norway, Poland and Spain.
Website:
www.imy.se
E-mail:
[email protected]
1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Registration number: DI-2021-10447 IMI. Case no. 134712. 2(6)
Date: 2022-07-28
The complaint
The complainant essentially states that, on 9 May 2021, he unsuccessfully invoked his
rights pursuant Articles 17, 18, 19 and 21 of the GDPR. He further states that he has
not received any information or confirmation that all of his requests have been
handled.
What Klarna has stated
The company has mainly stated the following.
The company is the data controller for the processing to which the complaint relates.
The company confirms that it has received all requests by fax on 9 May 2021. On the
other hand, the complainant’s requests could not be met because it could not correctly
identify the complainant in order to confirm that the sender of the fax is the data
subject to whom the personal data relate. On 13 May 2021, the company contacted
the complainant by email asking him to provide additional information to ensure
identification. However, the complainant has not returned with reply. Since the
complainant has not been identified, the request for erasure, restriction or objection to
the processing of personal data has not been completed.
Justification of the decision
Applicable provisions, etc.
Concept of personal data
The data subject has a number of rights under Articles 15 – 22 of the General Data
Protection Regulation, including the right to erasure, restriction and to object to the
processing.
There is no formal requirement for making a request pursuant Article 17(1). However,
Article 12(2) states that the controller shall facilitate the exercise of data subject rights
under Articles 15 to 22, inter alia, Article 17(1).2
Pursuant to Article 17, the data subject shall have the right to have his or her personal
data erased by the controller without undue delay and the controller shall be obliged to
erase personal data without undue delay if they are no longer necessary for the
purposes for which they have been collected or otherwise processed.
Article 12(2) requires the controller to facilitate the exercise of the data subject’s rights
in accordance with, inter alia, Article 17.
Article 12(3) provides that where the data subject makes the request by electronic form
means, the information shall, where possible, be provided in electronic form, unless
otherwise requested by the data subject.
Pursuant to Article 12(4), where the controller does not take action on the request of
the data subject, the controller shall inform the data subject without delay and at the
latest within one month of receipt of the request of the reasons for not taking action
and on the possibility of lodging a complaint with a supervisory authority and seeking a
judicial remedy. According to recital 59 of the GDPR, controllers should, without undue
delay and at the latest within one month, be required to respond to data subjects’
2
See Gothenburg Administrative Court of Appeal, judgment of 30 November 2021 in Case No 2232-21, p. 3 f.
The Privacy Protection Authority Registration number: DI-2021-10447 IMI. Case no. 134712. 3(6)
Date: 2022-07-28
requests and to give reasons, where the controller does not intend to comply with any
such requests.
It follows from Article 12(6) that where the controller has reasonable doubts concerning
the identity of the natural person making the request referred to in Articles 15 to 21, the
controller may request the provision of additional information necessary to confirm the
identity of the data subject. The way in which the identification is to be carried out is
not regulated by the GDPR, but it is an assessment that the controller must make in
each case. It is only if there are reasonable grounds for doubting the identity that the
controller has the right to request additional information.
The European Data Protection Board (EDPB) Guidelines 01/2022 on data subject
rights - Right of access, inter alia:
In cases where the controller requests the provision of additional
information necessary to confirm the identity of the data subject, the
controller shall each time assess what information will allow it to
confirm the data subject’s identity and possibly ask additional questions
to the requesting person or request the data subject to present some
additional identification elements, if it is proportionate. Such additional
information should not be more than the information initially needed for
the verification of the data subject’s identity (authentication). In general,
the fact that the controller may request additional information to assess
the data subject’s identity cannot lead to excessive demands and to the
collection of personal data which are not relevant or necessary to
strengthen the link between the individual and the personal data
requested.3
Assessment of the Swedish Authority for Privacy Protection
(IMY)
The investigation shows that the complaint’s request was received by fax of 9 May
2021. IMY considers that at the time of the request, Klarna has reasonable doubts
concerning the identity of the natural person that the sender was the data subject to
whom the personal data relate or someone who had the right to act on his behalf.
Klarna was therefore entitled to request further information in order to confirm this.
On 13 May 2021, Klarna attempted to request such information by sending an email to
the email address previously provided by the complainant when contacting Klarna, but
Klarna states that the complainant has not responded. The fact that Klarna requested
additional identification data in order to confirm the identity of the complainant cannot
be considered disproportionate as the data may be considered necessary to
strengthen the link between the complainant and the requests.
It follows from Article 12(3) and (4) that when a data subject, or a person claiming to
be a data subject, requests to exercise his or her rights, the controller is obliged to take
a decision whether or not the request is complied with and to what extent and to what
extent and to what extent it is communicated. If the decision is positive, i.e. compliance
with the request, the controller shall inform about the measures taken (Article 12(3)). If
the decision is negative, the controller shall inform the data subject of the reasons for
the failure to act and of the possibility to lodge a complaint with a supervisory authority
3
European Data Protection Board Guidelines 01/2022 on data subjects’ rights — right of access, version 1.0, adopted
on 18 January 2022, paragraph 65..
The Privacy Protection Authority Registration number: DI-2021-10447 IMI. Case no. 134712. 4(6)
Date: 2022-07-28
and request a judicial remedy (Article 12(4)). This applies even if the identity of the
requesting person could not be verified in accordance with Article 12(6). In order for
the requesting person to be able to exercise his or her rights under Article 12(4), where
the controller has not been able to confirm his identity, the requesting person needs to
be informed of the negative decision, preferably by the contact information specified in
the request.
It is apparent from the investigation that Klarna did not handle the complainant’s
request because it considered that the complainant’s identity could not be ascertained
by the information available. The company was then under an obligation under Article
12(4) to inform it because that was the reason why no action was taken in response to
the request. It is not clear from the investigation whether the information sent by the
company in response to the request to the e-mail address that the company had
registered for the applicant contained an indication that the request would not be
processed unless identification data were received. However, it is irrelevant for
assessing whether Klarna has fulfilled its obligation under Article 12(2) to facilitate the
exercise of the data subject’s rights. Klarna did not do so because they did not send
the request for identification through the contact details provided by the complainant in
the request received by fax. As explained above, there are no formal requirements for
making a request under Article 17(1). Klarna would therefore at least have sent this
information by the contact details provided by the request, so that the person claiming
to be registered could be informed of the reason why the request would not be
processed unless additional information was submitted, for example if he no longer
had access to the e-mail address. It has not emerged from the investigation that it
would impose unnecessary personal data processing or unreasonable burden on
Klarna to provide the information in this way. The fact that Klarna sent information to
the e-mail address that it had registered may be regarded as a security measure, but
not sufficient to facilitate the exercise of the complainant’s rights in this case.
IMY therefore concludes that Klarna Bank AB has infringed Article 12(2) GDPR by not
facilitating the exercise of the complainant’s right under Article 17 to have his data
deleted in accordance with its request of 9 May because Klarna Bank AB’s request for
identification data was not sent out via the contact details provided by the complainant
at the request.
Choice of intervention
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the
power to impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) provides which factors are to be taken into
account when deciding on administrative fines and in determining the amount of the
fine.
In the case of a minor infringement, as stated in recital 148, IMY may, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Factors to consider is
the aggravating and mitigating circumstances of the case, such as the nature, gravity
and duration of the infringement and past relevant infringements.
The Privacy Protection Authority Registration number: DI-2021-10447 IMI. Case no. 134712. 5(6)
Date: 2022-07-28
IMY notes the following relevant facts. The company infringed Article 12(2) of the
GDPR by failing to inform the complainant of the reasons why the complainant’s
request for deletion was not met. On the other hand, Klarna contacted the complainant
without undue delay, even if it was not via the contact details provided by the
complainant in its request. Against this background IMY considers that it is a minor
infringement within the meaning of recital 148 and that Klarna Bank AB must be given
a reprimand pursuant to Article 58(2)(b) of the GDPR.
This decision has been taken by the specially appointed decision-maker, legal advisor
, following a presentation by .
The Privacy Protection Authority Registration number: DI-2021-10447 IMI. Case no. 134712. 6(6)
Date: 2022-07-28
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection. Please indicate in your letter the decision you want to appeal and
the amendment that you are requesting. The appeal must reach the Swedish Authority
for Privacy Protection no later than three weeks from the date on which you received
the decision. If the appeal has been received in due time, the Swedish Authority for
Privacy Protection will forward it to the Administrative Court in Stockholm for review.
You can send the appeal by e-mail to IMY if the appeal does not contain any sensitive
personal data or information that may be subject to confidentiality. The Swedish
Authority for Privacy Protection’s contact details are set out in the first page of the
decision.