1(7)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY)
decision, no. DI-2022-1722. Only the Swedish version of
the decision is deemed authentic.
Registration number:
DI-2022-1722, IMI case no. Decision under the General Data
368751,
521.14039 / 631.336 Protection Regulation – Klarna Bank
AB
Date of decision:
2022-07-25
Decision of the Swedish Authority for Privacy
Protection (IMY)
IMY finds that Klarna Bank AB has processed personal data in violation of:
• Article 12(2) GDPR1 by not facilitating the exercise of the complainant’s right
under Article 15 for access to their personal data in accordance with their
request of 8 February 2021, by misinterpreting the complainant’s request for
access and requesting a clarification from the complainant without valid
reason;
• Articles 12(3) and 17 of the GDPR by not responding without undue delay to
the complainant’s requests for erasure of 2 May 2019 only on 31 January
2020 and 16 January 2021 only on 31 August 2021.
IMY gives Klarna Bank AB a reprimand pursuant to Article 58(2)(b) of the GDPR for
breach of Articles 12(2), 12(3) and 17 of the GDPR.
Report on the supervisory case
The case handling
IMY has initiated supervision regarding Klarna Bank AB (Klarna or the company) due
to a complaint. The complaint has been submitted to IMY, in its capacity as lead
supervisory authority under Article 56 of the GDPR. The handover has been made by
the supervisory authority of the country where the complainant has lodged their
complaint (Germany) in accordance with the GDPR’s provisions on cooperation
concerning cross-border processing.
Postadress:
Box 8114 The investigation in the case has been carried out through correspondence. In light of
104 20 Stockholm a complaint relating to cross-border processing, IMY has used the mechanisms for
Webbplats: cooperation and consistency contained in Chapter VII GDPR. The supervisory
www.imy.se
E-post:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
IMY Diarienummer: DI-2022-1722 2(7)
Datum: 2022-07-25
authorities concerned has been the data protection authorities in Germany, Denmark,
Austria, Italy, Poland and Finland.
The complaint
The complainant mainly states the following.
Several accounts have been registered with Klarna with the complainant’s email
address or their postal address under someone else’s name. The complainant has not
personally registered any of those accounts and has requested erasure with Klarna on
several occasions, because accounts have recurrently been created in this way for a
long period of time. Klarna has not complied with several of the requests and therefore
Klarna has not erased all of the complainant’s personal data.
The complainant has also requested information on the number of accounts created
with their postal address, but has not received such information. It is apparent from an
e-mail the complainant sent to Klarna on 8 February 2021, that they requested a
detailed list of registered accounts relating to the complainant that Klarna had already
erased, and accounts created with the complainant’s address data.
What Klarna has stated
Klarna Bank AB mainly states the following.
Klarna is the data controller for the processing to which the complaint relates.
Klarna has received three requests for erasure on 2 May 2019, 30 November 2019
and 16 January 2021. All requests have been handled.
The request for erasure on 2 May 2019 was initiated on 11 December 2019 and was
completed on 31 January 2020. At the time of the complainant’s request, the
complainant claimed that their personal data had been used in connection with fraud
and the case was therefore forwarded to the department at Klarna that handles fraud
cases. In connection with the closure of the fraud case, the case concerning the
complainant’s request for erasure was also erroneously closed by the case handler.
The request for erasure on 30 November 2019 was initiated on 11 December 2019
and completed on 31 January 2020. The complainant was informed on 30 November
2019 that the request could take up to 90 days. The reason for this was that the
number of incoming cases had periodically been very large and that the handling of
data subject request during that time sometimes had taken more than a month. Klarna
has handled the request without undue delay, also considering the Christmas and New
Year’s holidays.
The request for erasure on 16 January 2021 was completed on 31 August 2021. On
16 February 2021, Klarna informed the complainant that the handling could take more
than one month. Subsequently, the case handler did not proceed with the process for
data subject requests according to Klarna’s routines. The complainant’s request was
therefore not dealt with in accordance with Klarna’s procedures at the time due to the
individual case handler’s error.
Klarna has not interpreted the complainant’s request for the number of accounts
created with their personal data as a request for access. The question was made to
Klarna on 8 February 2021 and the complainant was offered an extract from the
register on 16 February 2021, which was not answered by the complainant. The
IMY Diarienummer: DI-2022-1722 3(7)
Datum: 2022-07-25
complainant returned with a reply which Klarna perceived as a request for erasure and
further questions on how the complainant’s personal data had been used in connection
with suspected fraud.
Klarna was contacted by the data protection authority in Berlin on 4 August 2021
where it was informed, inter alia, that that authority interpreted the question from the
complainant as a request for access by the complainant. Klarna subsequently
responded to the complainant’s request for access by sending an extract from the
register by mail on 26 August 2021.
Justification of the decision
Applicable provisions
According to Article 12(2) of the GDPR, the controller shall facilitate the exercise of the
data subject’s rights in accordance with, inter alia, Article 15.
According to Article 12(3) of the GDPR, the data subject’s request to exercise his or
her rights must be handled without undue delay and in any event no later than one
month after the request is received. The period of one month may be extended by a
further two months if the request is particularly complex or if the controller receives a
high number of requests.
Pursuant to Article 15 of the GDPR, the data subject shall have the right to obtain from
the controller confirmation of whether personal data concerning him or her are being
processed. If such data are processed, the controller shall provide the complainant
with additional information and a copy of the personal data processed by the controller.
In the European Data Protection Board’s (EDPB) Guidelines 01/2022 on access, it is
considered sufficient for a data subject to indicate that they wish to have access to
their personal data in order for a request for access under Article 15 to have been
made.2 The data subject does not have to explicitly clarify that this is a request for
access or refer to the GDPR. If the controller has any doubts as to what right the data
subject wishes to exercise, the controller is recommended to contact the data subject
and request clarification. If the data subject does not respond, the controller shall
interpret the information contained in the first request of the data subject and act
accordingly.3 Furthermore, a data subject who has been the victim of identity theft shall
be provided with information on all personal data relating to his or her identity,
2 EDPB Guidelines 01/2022 on data subject rights — Right of access, adopted for public consultation on 18 January
2022, para. 50, MY translation; original: “In order to make the access request, it is sufficient for the requesting
persons to specify that they want to know what personal data concerning them the controller processes. Therefore,
he controller cannot refuse to provide the data by referring to the lack of indication of the legal basis of the request,
especially to the lack of a specific reference to the right of access or to the GDPR. For example, in order to make a
request, it would be sufficient for the requesting persons to indicate that they wish to obtain access to personal data
concerning them.”
3 EDPB Guidelines 01/2022 on data subject rights — Right of access, adopted for public consultation on 18 January
2022, paragraph 48, IMY translation; original: “If the controller has doubts as to which right the data subject wishes to
exercise, it is recommended to ask the data subject making the request to explain the subject matter of the request.
Such correspondence with the data subject shall not affect the duty of the controller to act without undue delay.
However, in case of doubts, if the controller asks the data subject for further explanation and receives no response,
he controller should interpret, bearing in mind the obligation to facilitate the exercise of the person’s right of access,
he informa ion contained in the first request and act on its basis.”
IMY Diarienummer: DI-2022-1722 4(7)
Datum: 2022-07-25
including personal data collected by the controller as a result of the fraudster’s
conduct.4
Pursuant to Article 17(1)(a) of the GDPR, the data subject shall have the right to have
his or her personal data erased by the controller without undue delay and the controller
shall have the obligation to erase personal data without undue delay if they are no
longer necessary in relation to the purposes for which they were collected or otherwise
processed. Article 17(3) of the GDPR exhaustively lists the exceptions to this right.
IMY:s assessment
Klarna has not handled two of the complainant’s requests for erasure in
accordance with the General Data Protection Regulation
A request for erasure shall be handled without undue delay and at the latest within one
month from when the request was received the controller pursuant to Article 12(3)
GDPR. However, the period of one month may be extended for a further two months
under the conditions laid down in the same article.
Klarna states that a request for erasure was received on 30 November 2019 and was
completed on 31 January 2020, i.e. two months after it was received. Klarna had
previously informed the complainant on 30 November 2019 that the request may take
up to 90 days due to the amount of incoming cases and considering Christmas and
New Year’s holidays. IMY finds no reason to question Klarna’s information in this
regard. IMY therefore considers that Klarna has given the complainant such a
notification that is required by Article 12(3) in the event of an extension of the one-
month time limit for handling a request. In light of Klarna’s submissions on the large
number of requests received during the current period of Christmas and New Year,
IMY considers that Klarna has handled the request of 30 November 2019 without
undue delay.
Regarding the requests for erasure of 2 May 2019 and 16 January 2021, Klarna did
not complete them until more than seven months after the respective requests were
made. Consequently, Klarna did not handle the complainant’s requests within the
statutory time limit. Klarna’s argument that the reason for the delays concern
oversights by individual case handlers does not alter IMY:s assessment. Therefore,
Klarna did not handle the complainant’s requests for erasure of 2 May 2019 and 16
January 2021 without undue delay.
Against this background, IMY finds that Klarna Bank AB has processed personal data
in breach of Articles 12(3) and 17 of the GDPR by not deleting the complainant’s
personal data without undue delay, as requested by the complainant on 2 May 2019
only on 31 January 2020, and of 16 January 2021 only on 31 August 2021.
Klarna has not handled the complainant’s request for access in accordance with
the General Data Protection Regulation
It is apparent from the file that the complainant suspects that they were the victim of
identity theft and, as a result, requested a detailed list from Klarna on 8 February 2021
4 EDPB Guidelines 01/2022 on data subject rights — Right of access, adopted for public consultation on 18 January
2022, para. 105, IMY:s translation; original: “In case of identity theft, a person fraudulen ly acts in the name of another
person. In this context it is important to recall that the victim should be provided with information on all personal data
he controller stored in connection with their identity, including those that have been collected on the basis of the
fraudster’s ac ions. In other words, even after he controller learned about the identity theft, personal data is
associated wi h or related to the iden ity of the victim and hence constitutes personal data of the data subject.”
IMY Diarienummer: DI-2022-1722 5(7)
Datum: 2022-07-25
concerning, on the one hand, accounts related to the complainant that Klarna had
erased and, on the other hand, accounts created with the complainant’s address data.
IMY considers that the complainant’s request for a “detailed list” of 8 February 2021
should be interpreted as a request for access under Article 15 of the GDPR. There is
no formal requirement for making a request under Article 15. However, Article 12(2)
states that the controller shall facilitate the exercise of data subjects’ rights under, inter
alia, Article 15. Klarna should therefore have understood from the communication that
the complainant wanted access to personal data they had a right to under Article 15 of
the GDPR.5
According to the General Data Protection Regulation, it is Klarna’s responsibility as
data controller to be able to identify and act on a request for access from a data
subject, as is also made apparent from the EDPB guidelines.6 IMY considers that there
was no reason for Klarna to request clarification from the complainant in the present
situation. Moreover, Klarna has described to the complainant only in general terms
how they could proceed to request an extract from the register if they intended to make
a request for access, in the e-mail sent by Klarna on 16 February 2021. Therefore, the
fact that Klarna considered that the complainant had not provided a clear answer after
Klarna had offered an extract from the register does not alter IMY:s assessment.
Given these circumstances, IMY notes that Klarna Bank AB has processed personal
data in breach of Article 12(2) by not facilitating the exercise of the complainant’s right
under Article 15 to access their personal data, by misinterpreting the complainant’s
request for access of 8 February 2021 and seeking clarification from the complainant
without reason.
Choice of intervention
Article 58(2) and Article 83(2) of the GDPR gives IMY the authority to impose
administrative fines in accordance with Article 83. Depending on the circumstances of
the case, administrative fines shall be imposed in addition to or in place of the other
measures referred to in Article 58(2), such as warnings and prohibitions. Furthermore,
it is clear from Article 83(2) which factors are to be taken into account when deciding
whether to impose administrative fines and in determining the amount of the fine. In
the case of a minor infringement, as stated in recital 148, IMY may issue a reprimand
pursuant to Article 58(2)(b) instead of imposing a fine. Herein considering the
aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement and past relevant infringements.
IMY notes the following relevant facts. The violations have affected one person and
have occurred because of mistakes on the part of Klarna. This applies both to the
complainant’s requests for erasure and to the request for access. Although Klarna had
not complied with the complainant’s request for access due to a misinterpretation of
the complainant’s request, Klarna did not intend to deny the complainant access to
their personal data. Against this background, IMY considers that these are minor
infringements within the meaning of recital 148 which means that Klarna Bank AB shall
be given a reprimand under Article 58(2)(b) of the GDPR for the infringements.
5 EDPB Guidelines 01/2022 on data subject rights — Right of access, adopted for public consultation on 18 January
2022, para. 105.
6 EDPB Guidelines 01/2022 on data subject rights — Right of access, adopted for public consultation on 18 January
2022, paras. 48 and 50.
IMY Diarienummer: DI-2022-1722 6(7)
Datum: 2022-07-25
___________________________________________________
This decision has been taken by the specially appointed decision-maker, legal advisor
, following a presentation by legal advisor .
IMY Diarienummer: DI-2022-1722 7(7)
Datum: 2022-07-25
How to appeal
If you wish to appeal IMY:s decision, please write to IMY. Please indicate in your letter
the decision you are appealing and the amendment that you are requesting. The
appeal must reach IMY no later than three weeks from the date on which you received
the decision. If the appeal has been received in due time, IMY forwards it to the
Administrative Court in Stockholm for trial.
You can send the appeal by email to IMY if the appeal does not contain any sensitive
personal data or information that may be subject to confidentiality. IMY:s contact
details are set out in the first page of the decision.