1(5)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision
2022-11-15, no. IMY-2022-636. Only the Swedish version
of the decision is deemed authentic.
Ref no:
IMY-2022-636, Decision under the General Data
IMI case no. 134681
Protection Regulation – Klarna Bank
Date of decision:
15 November 2022 AB
Date of translation:
2022-11-15
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has processed
personal data in breach of Article 12(3) and 17 of the General Data Protection
Regulation1 by not having accommodated the complainant’s request for erasure made
on 25 June 2020 without undue delay. The complainant’s request was not
accommodated until 31 December 2020.
The Swedish Authority for Privacy Protection issues a reprimand to Klarna Bank AB
pursuant to Article 58(2)(b) of the General Data Protection Regulation for the
infringement of Article 12(3) and 17 of the General Data Protection Regulation.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated an inspection
regarding Klarna Bank AB (Klarna or the company) due to a complaint. The complaint
has been submitted to IMY, as responsible supervisory authority for the company’s
operations pursuant to Article 56 of the General Data Protection Regulation (GDPR).
The handover has been made from the supervisory authority of the country where the
complainant has lodged their complaint (Germany) in accordance with the provisions
of the GDPR on cooperation in cross-border processing.
The case has been handled through written procedure. In the light of the complaint
relating to cross-border processing, IMY has used the mechanisms for cooperation
and consistency contained in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Germany, Norway, Denmark,
Finland and Italy.
Postadress:
Box 8114
104 20 Stockholm The complaint
Webbplats: The complainant has mainly stated the following. On 25 June 2020, he requested
www.imy.se erasure under Article 17 of the GDPR. Klarna replied the same day, stating that the
E-post:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-636 2(5)
Datum: 2022-11-15
complainant’s data would be erased but that it could take up to 90 days for the request
for erasure to be completed. The complainant requested to exercise his right of access
to his personal data on 30 September 2020 and thereby discovered that his data had
not been deleted. As Klarna had not complied with the request made on 25 June 2020,
the complainant again requested the erasure of his personal data.
What Klarna has stated
Klarna has mainly stated the following.
Klarna is the data controller concerning the processing to which the complaint relates.
Klarna received three requests for erasure, namely on 25 June 2020, on 13 October
2020 and on 20 October 2020. All requests were dealt with.
Erasure of the personal data was initiated on 25 June 2020 following the request for
erasure made on that day. A part of the complainant’s personal data was erased. Due
to a temporary technical error, the complete erasure was not completed immediately
but only on 31 December 2020 in connection with the request received on 13 October
2020. The complainant was informed on 25 June 2020 that the processing of the
request could take up to 90 days and that the process of erasure had started. The
reason for the delay was a high workload.
The request for erasure dated 13 October 2020 was finalized on 31 December 2020.
The complainant was informed on 14 October 2020 that the erasure of his personal
data had started. Klarna informed the complainant already on 25 June 2020 that the
process of erasure could take up to 90 days. This is the reason why Klarna on 14
October 2020 only informed the complainant that the process of erasure had been
started and not how long it would take to handle the request.
The request for erasure dated 20 October 2020 was handled together with the request
dated 13 October 2020 and was thus also finalized on 31 December 2020.
Klarna has handled the complainant’s request received on 13 October 2020 as well as
the one received on 20 October 2020 without undue delay, considering the large
amount of cases Klarna had to deal with at the time of the complainant’s request.
Klarna further states that the company continuously improves its processes to ensure
data subjects’ rights under the GDPR. Klarna’s customer service has improved its
structure and prioritization in order to reduce the processing time of the cases received
that relate to data protection. The improvements implemented since the complainant’s
requests were received ensure that the processing time is now considerably shorter.
Statement of reasons for the decision
Applicable provisions, etc.
According to Article 12(3) of the GDPR, the individual’s request to exercise his or her
rights must be dealt with without undue delay and in any event within one month of
receipt of the request. That period may be extended by two further months if the
request is particularly complex or the number of requests received is high. The
controller shall inform the data subject of such an extension within one month of
receipt of the request and shall state the reasons for the delay.
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-636 3(5)
Datum: 2022-11-15
Pursuant to Article 17(1), the data subject shall have the right to obtain from the
controller the erasure of personal data concerning him or her without undue delay.
Furthermore, the controller shall have the obligation to erase personal data without
undue delay where one of the conditions set out in that Article exists, for example
where the data is no longer necessary for the purposes for which it was collected or if
the consent for processing is withdrawn. Article 17(3) lists the exceptions applicable to
this right.
Assessment by IMY
The investigation has shown that the complainant’s request for erasure was received
by Klarna on 25 June 2020 and that Klarna on the same day informed the complainant
that it would take up to 90 days to complete the deletion. According to IMY’s
understanding, the complainant sent Klarna reminders on 13 and 20 October 2020
regarding its request of 25 June 2020. These reminders do therefore not constitute
new requests for erasure. According to Klarna, the request was fully accommodated
on 31 December 2020. IMY sees no reason to question this.
Klarna accommodated the complainant’s request for erasure only later than six months
after the receipt of the request. IMY therefore concludes that Klarna did not handle the
complainant’s request without undue delay within the meaning of Article 12(3) and 17
of the GDPR. Klarna’s argument that a temporary technical error led to the fact that
erasure was not completed in time, that Klarna’s processes have improved and that
the processing time is now shorter does not change IMY’s assessment.
Choice of corrective measure
According to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Account needs to be taken to the
aggravating and mitigating circumstances of the case, such as the nature, gravity and
duration of the infringement as well as past infringements of relevance.
IMY notes the following relevant circumstances. The violations of the GDPR have
affected one person and are the result of mistakes on the part of Klarna. Although
Klarna did not accommodate the complainant’s request for erasure without undue
delay, it does not appear that Klarna intended to deny the complainant the right to
erasure. In the light of the foregoing, IMY considers, in an overall assessment, that
there is such a minor infringement within the meaning of recital 148. Klarna should
therefore be given a reprimand under Article 58(2)(b) of the GDPR for the breach
found.
Against this background, IMY considers that it is a minor infringement within the
meaning of recital 148 and that Klarna must be given a reprimand pursuant to Article
58(2)(b) of the GDPR.
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-636 4(5)
Datum: 2022-11-15
___________________________________________________
This decision has been approved by the specially appointed decision-maker, legal
advisor following a presentation by legal advisor
.
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-636 5(5)
Datum: 2022-11-15
How to appeal
If you want to appeal the decision, you should write to the Swedish Authority for
Privacy Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Swedish Authority for Privacy
Protection no later than three weeks from the day you received the decision. If the
appeal has been received at the right time, the Swedish Authority for Privacy
Protection will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Swedish Authority for Privacy Protection if it does not
contain any sensitive personal data or information that may be subject to
confidentiality. The authority’s contact information is shown on the first page of the
decision.