1(2)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s (IMY)
decision 2022-10-17, no. DI-2022-4999. Only the
Swedish version of the decision is deemed authentic.
Registration number:
DI-2022-4999 IMI. Case no. Final decision under the General Data
164557, LDA 1085.1-3396/20-F
Protection Reglation – Klarna Bank
Date of final decision:
2022-10-17 AB
Date of translation:
2022-10-17
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that the investigation has not
shown that Klarna Bank AB has processed the complainant’s personal data in breach
of Articles 12(3) and 17 of the General Data Protection Regulation (GDPR)1 in the
manner alleged in the complaint.
The case is closed.
Report on the supervisory report
Processing
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (the company or Klarna) due to a complaint. The complaint has been
submitted to IMY, as responsible supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation from the supervisory
authority in (Germany) where the complainant has lodged their complaint in
accordance with the GDPR’s provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since this is a complaint relating to cross-border processing, IMY has used the
mechanisms for cooperation and consistency contained in Chapter VII GDPR. The
supervisory authorities concerned has been the data protection authorities in
Denmark, Germany, Poland, Italy, Finland and Austria.
The complaint
In its complaint, the complainant essentially stated the following. Complainants
Postal address:
Box 8114 personal data have been confused with data relating to another person who has the
104 20 Stockholm same first name and surname. In the role of complainants working life, it is important
Website: that his personal data cannot be linked to a due claim. The complainant has requested
www.imy.se
E-mail:
[email protected]
1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Registration number: DI-2022-4999 IMI. Case no. 164557. 2(2)
Date: 2022-10-17
the deletion of his personal data from Klarna and he has not received confirmation that
the deletion has taken place.
What Klarna has stated
Klarna Bank AB has mainly stated the following. Klarna is not the data controller for
the current processing to which the complaint relates. Klarna has never processed
personal data about the complainant and there has therefore been no personal data to
be deleted.
Klarna has previously had a claim for payment against a person with the same first
name and surname as the complainant. This requirement has been transferred in 2015
to an external party in accordance with the rules on negotiable debt instrument. The
possible confusion has occurred after Klarna has transferred the claim to a third party.
Justification of the decision
Justification of the decision
Applicable provisions, etc.
Pursuant to Article 12(3) GDPR the controller must comply with the data subject’s
request without undue delay and in any event within one month of receipt of the
request.
Pursuant to Article 17 of the GDPR, the data subject shall have the right to have his or
her personal data erased without undue delay under certain conditions specified
therein.
Assessment of the Swedish Authority for Privacy Protection (IMY)
Klarna Bank AB has stated, on 28 July 2022, that Klarna has never processed the
complainant’s personal data and is therefore not the data controller for the processing
of personal data to which the complaint relates. Furthermore, the company has
processed another person’s personal data with the same first name and surname in
relation to an overdue claim.
IMY notes that there has been no reason to question what the company has stated.
Against this background, IMY finds that the investigation at hand has not shown that
Klarna Bank AB failed to comply with the General Data Protection Regulation in the
manner alleged in the complaint.
The case is closed.
This decision has been made by the specially appointed decision-maker
after presentation by legal advisor