1(3)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection’s (IMY)
decision, 2023-05-26 no. IMY-2023-2978. Only the
Swedish version of the decision is deemed
authentic.
Registartion number
IMY-2023-2978 IMI.Case
491994 Complaint, LDA-
1085.310276/20-1. Final decision pursuant to Article 60
Date of final decision:
2023-05-26
under the General Data Protection
Date of translation: Regulation — Klarna Bank AB
2023-03-22
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that the investigation has not
shown that Klarna Bank AB has processed the complainant’s personal data in breach
of Articles 12(3) and 15 of the General Data Protection Regulation (GDPR)1 in the
manner alleged in the complaint.
The case is closed.
Report on the supervisory report
Processing
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (the company or Klarna) due to a complaint. The complaint has been
submitted to IMY, as responsible supervisory authority for the company’s operations
pursuant to Article 56 of the General Data Protection Regulation from the supervisory
authority in (Germany) where the complainant has lodged their complaint in
accordance with the GDPR’s provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since this is a complaint relating to cross-border processing, IMY has used the
mechanisms for cooperation and consistency contained in Chapter VII GDPR. The
Postal adress: supervisory authorities concerned has been the data protection authorities in
Box 8114
Denmark, Germany, Norway, Netherlands, Poland, Italy, Finland and Austria.
104 20 Stockholm
Website: The complaint
www.imy.se
In its complaint, the complainant essentially stated the following. On 9 October 2020,
E-mail:
[email protected]
1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Phone protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Page 1 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-2978 2(3)
Datum: 2023-03-22
the complainant requested access to his/her personal data in according to Article 15 of
the GDPR. The complainant received no information or document from Klarna. The
complainant received only one automatic e-mail from Klarna, which contained
information that it had received the complainant’s e-mail concerning the request for
access to her/his personal data.
What Klarna has stated
Klarna Bank AB has mainly stated the following. Klarna is not the data controller for
the current processing to which the complaint relates. The request was received by
Klarna on 9 October 2020. Klarna has handled the request received and has taken
these following steps. On 12 October 2020, Klarna’s customer service asked the
complainant to add information about his/her identity and requested which of the
complainant’s e-mail inbox was used for the purchase from Klarna. The complainant
has not returned with reply. At the time of the request, Klarna had reason to doubt the
complainant’s identity and was therefore unable to fulfil his/her´s request.
The complainant’s request was one of the complaints communicated to Klarna with the
supervisory authority in Germany (Berlin) in June to August 2021. In connection with
the contact with the he supervisory authority in Germany (Berlin), information was sent
to the complainant pursuant to Article 15, by post on 13 August 2021 and Klarna
informed the complainant by e-mail the same day.
Klarna considers that information to the complainant has been provided within the
specified timeframe in pursuant to Articles 12(3) and 15 of the GDPR after the
complainant has provided the necessary information regarding his/her identity.
Justification of the decision
Applicable provisions, etc.
Article 12(3) of the GDPR requires the controller to provide the data subject, upon
request, without undue delay and in any event no later than one month after receiving
the request, with information on the actions taken pursuant to Article 15. The one-
month time limit may be extended by a further two months where the request is
particularly complex or the number of requests received is high. If the time limit of one
month is extended, the controller shall inform the data subject of the extension.
Notification of the extension of the deadline shall take place within one month of
receipt of the request. The controller shall also indicate the reasons for the delay.
Without prejudice to Article 11, where the controller has reasonable grounds to doubt
the identity of the natural person making a request pursuant to Articles 15 to 21, the
controller may request the provision of additional information necessary to confirm the
identity of the data subject. This is clear in Article 12(6).
Pursuant to Article 15, the data subject has the right to obtain from the controller a
copy of the personal data processed by the controller. The data subject shall also
receive other information, such as the purpose for which the personal data are
processed and to which recipients or categories of recipients the data are disclosed.
Assessment of the Swedish Authority for Privacy Protection (IMY)
Page 2 of 3
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-2978 3(3)
Datum: 2023-03-22
The investigation shows that Klarna Bank AB has started handling the complainant’s
request for access of personal data within one week of receipt of the request. Klarna
has also informed the complainant that the processing of the request for access will
commence as soon as sufficient information is received to verify the complainant.
The request was completed on the same day as additional information was received to
the company. IMY considers that there has been no reason to question Klarna’s
information in this part.
IMY considers that the complainant’s request has been handled and fulfilled without
undue delay within the meaning of Article 12(3) and 15 of the GDPR.
Against this background, IMY notes that the investigation in the case has not shown
that Klarna Bank AB has processed the complainant’s personal data in breach of
Article 12(3) and 15 of the GDPR.
The case is closed.
Page 3 of 3