**IMY** Integritetsskydds
myndigheten
1(6)
**Notice:** This document is an unofficial translation of the Swedish Authority for Privacy Protection's (IMY) decision 2022-05-27, no. DI-2022-222. Only the Swedish version of the decision is deemed authentic.
**Ref no:**
DI-2022-222, IMI number:
336110
**Date of decision:**
2022-05-27
**Date of translation:**
2022-08-25
## Beslut efter tillsyn enligt dataskyddsförordningen – Klarna Bank AB
### Decision of the Swedish Authority for Privacy Protection (IMY)
The Authority for Privacy Protection (IMY) finds that Klarna Bank AB has processed personal data in breach of
- articles 12(3) and 17 GDPR¹ by not informing the complainant without undue delay until 17 September 2021 of the measures taken in response to the request for deletion of 16 August 2021; and
- articles 12(3) and 21(2) by not ceasing the processing of personal data of the complainant for direct marketing purposes without undue delay until 9 September 2021, following the objection of 16 August 2021;
The Swedish Integrity Protection Authority gives Klarna Bank AB a reprimand in accordance with Article 58(2)(b) of the GDPR.
### Report on the supervisory report
The Authority for Privacy Protection (IMY) has initiated supervision regarding Klarna Bank AB (Klarna or the company) due to a complaint. The complaint has been submitted to IMY, as responsible supervisory authority for the company's operations pursuant to Article 56 of the General Data Protection Regulation (GDPR). The handover has been made from the supervisory authority of the country where the complainant has lodged their complaint (Germany, Berlin) in accordance with the Regulation's provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through correspondence. In the light of a complaint relating to cross-border processing, IMY has used the mechanisms for cooperation and consistency contained in Chapter VII GDPR. The supervisory authorities concerned have been the data protection authorities in Norway, Ireland, Germany, Poland, Spain, Italy and Finland.
#### The complaint
The complaint states the following. The complainant has received payment reminders from Klarna following a purchase from Wayfair Inc. The complainant then has (i) objected to Klarna's processing of the applicant's personal data in general and (2)
**Postadress:**
Box 8114
104 20 Stockholm
**Webbplats:**
www.imy.se
**E-post:**
[email protected]
**Telefon:**
08-657 61 00
Integritetsskyddsmyndigheten
Diarienummer: DI-2022-222^{}[] Datum: 2022-05-27
2(6)
objected to direct marketing and (3) requested the deletion of his personal data.
### **What Klarna has stated**
Klarna has mainly stated the following.
Klarna is the data controller for the processing to which the complaint relates.
Klarna received the objection to direct marketing and the objection to the processing of the complainant's personal data on 16 August 2021. Klarna states that the processing carried out in connection with the direct marketing is based on the legal bases set out in Article 6(1)(e) and (f) of the GDPR. The processing has ceased as of 9 September 2021, except in cases where Klarna has legitimate interests for the processing that outweigh the interests of the complainant, such as fraud prevention in future purchases.
On 9 September 2021, Klarna blocked the complainant from further marketing communications from the company.
Klarna received a request for erasure on 16 August 2021. Following the request, Klarna asked the complainant to provide information to confirm his identity. The complainant did not return to that information. In violation of Klarna's procedures and by error of an employee, erasure of the complainant's personal data has nevertheless started on 17 September 2021 and was completed on 17 October 2021. Due to Klarna's failure to verify the identity of the complainant, the time limit in Article 12(3) of the GDPR has not started to run.
## **Justification of the decision**
### **Applicable provisions, etc.**
According to Article 12(3) of the GDPR, upon request, the controller must comply with the individual's request without undue delay and in any event no later than one month after receiving the request. The period of one month may be extended by a further two months if the request is particularly complex or the number of requests received is high. If the deadline of one month is extended, the controller shall notify the individual of the extension. The extension of the time limit shall be notified within one month of receipt of the request. The controller shall also state the reasons for the delay.
Without prejudice to Article 11, where the controller has reasonable grounds to doubt the identity of the natural person submitting a the request pursuant to Articles 15 to 21, request the provision of additional information necessary to confirm the identity of the individual. This is developed in Article 12(6).
Under Article 17(1)(c), individuals have the right to have their personal data erased without undue delay when they object pursuant to Article 21(1).
Under Article 21(1), the individual shall have the right, on grounds relating to his or her specific situation, to object at any time to processing of personal data concerning him or her based on Article 6(1)(e) (information in the public interest or the exercise of official authority) or (f) (legitimate interest), including profiling based on those provisions. The controller shall no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the individual, or for the establishment, exercise or
Integritetsskyddsmyndigheten
Diarienummer: DI-2022-222^{}[] Datum: 2022-05-27
3(6)
defense of legal claims.
Under Article 21(2), the individual always has the right to object to the use of his or her personal data for direct marketing purposes. If the personal data are objected to by way of direct marketing, the personal data shall no longer be processed for such purposes, as follows from Article 21(3).
Article 12(3) requires that a request under Article 21 be dealt with without undue delay and in any event within one month at the latest. That period may be extended by a further two months, if necessary, taking into account the complexity of the request and the number of requests received.
According to the European Data Protection Board's (EDPB) Guidelines 01/2022 on access, the calculation of the one-month deadline in Article 12(3) is calculated from the date of receipt of the request. However, where, upon receipt of the request, a controller needs to take steps to ensure the identity of the data subject, the time limit may be suspended until the controller has received the information necessary to identify the data subject. This is provided that the request for further information has been made without undue delay.¹
## Assessment of the Authority for Privacy Protection (IMY)
Has Klarna handled the complainant's objection under Article 21(1) correctly? The investigation into the case shows that the complainant's objection to the processing of personal data was raised on 16 August 2021. Klarna has stated that the company has ceased the processing of personal data based on the legal bases set out in Article 6(1)(e) and (f) on 9 September 2021, except in cases where Klarna has legitimate interest such as fraud prevention in future purchases. IMY finds no reason to question this. The question, therefore, is whether Klarna has done so without undue delay.
The complainant has exercised the right, pursuant to Article 21(1), to object to Klarna's processing of personal data based on Article 6(1)(e) and (f) on grounds relating to his or her specific situation. Since Klarna has not demonstrated the existence of legitimate grounds for the processing, Klarna was obliged to discontinue the processing without undue delay from when the request was received.
Klarna stopped treatment 24 days later. IMY considers that Klarna has ceased to process the complainant's data without undue delay and thus acted in accordance with Article 21(1) and (3) GDPR.
Has Klarna handled the appellant's objection to direct marketing under Article 21(2) correctly?
On 16 August, the complainant objected to direct marketing pursuant to Article 21(2) of the GDPR. Klarna has blocked the complainant from further marketing communications from the company on 9 September 2021.
IMY notes that, by exercising its absolute right under Article 21(2) to object to direct marketing, Klarna has been under an unconditional obligation under Article 21(3) to cease such processing of personal data without undue delay within the meaning of
¹ See EDPB Guidelines 01/2022 on data subject rights — Right of access, Version 1.0, adopted for public consultation on 18 January 2022, (EDPB Guidelines 01/2022 on access), p. 47 f; IMY's translation.
Integritetsskyddsmyndigheten
Diarienummer: DI-2022-222^{}[] Datum: 2022-05-27
4(6)
Article 12(3). Since, unlike a request under Article 21(1), there is no room for Klarna to weigh a request under Article 21(2), such a request should be able to be dealt with more hastily. Klarna ceased with the processing 24 days after the objection was received, which IMY finds not to have been without undue delay. Klarna has thus processed the complainant's personal data in breach of Articles 12(3) and 21(2) of the GDPR.
Has Klarna handled the appellant's request for deletion correctly?
The investigation shows that the applicant's request for erasure was received by Klarna on 16 August 2021. On 9 September 2021, i.e. 24 days later, Klarna considered it necessary to obtain additional information from the complainant in order to secure the complainant's identity and therefore requested additional information. Since the subject matter of the complaint does not relate to whether it was actually justified to request such information, IMY does not take a position this matter. However, IMY notes that by taking 24 days to request additional information, it cannot be considered to be without undue delay. The deadline for handling the request shall therefore not be considered to have been suspended in the period until Klarna started erasure and informed about it on 17 September 2021.
As regards the fulfilment of the request, Klarna started the erasure on 17 September 2021 and at the same time sent the complainant information about this and the maximum time the erasure could take. The erasure was completed on 15 October 2021, i.e. after 62 days, which IMY considers to have taken place without undue delay.2
However, Klarna informed the complainant of the measures taken only 32 days after the request was received. In those circumstances, IMY considers that Klarna has processed the applicant's personal data in breach of Articles 12(3) and 17 of the GDPR by informing the applicant only on 17 September 2021 of the measures taken in response to the request of 16 August 2021.
## Choice of corrective measure
It follows from Article 58(2)(i) and Article 83(2) of the GDPR that the IMY has the power to impose administrative fines in accordance with Article 83. Depending on the circumstances of the case, administrative fines shall be imposed in addition to or in place of the other measures referred to in Article 58(2), such as injunctions and prohibitions. Furthermore, Article 83(2) provides which factors are to be taken into account when deciding on administrative fines and in determining the amount of the fine. In the case of a minor infringement, as stated in recital 148, IMY may, instead of imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Factors to consider is the aggravating and mitigating circumstances of the case, such as the nature, gravity and duration of the infringement and past relevant infringements.
IMY notes the following relevant facts. The time that has passed before the company acted was relatively short. Nor has it been sensitive or privacy-sensitive data. The requests have now been handled by Klarna and completed. Against this background, IMY considers that these are minor infringements within the meaning of recital 148 and that Klarna Bank AB should therefore be given a reprimand under Article 58(2)(b) of the GDPR for the infringements found.
---2Cf. IMY Decision of 6 December 2021, dnr DI-2021-2135.
Integritetsskyddsmyndigheten
Diarienummer: DI-2022-222
Datum: 2022-05-27
5(6)
This draft decision has been approved by the specially appointed decision-maker
after presentation by legal advisor
Copy to
Data Protection Officer
Integritetsskyddsmyndigheten
Diarienummer: DI-2022-222
Datum: 2022-05-27
6(6)
## How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy Protection. Indicate in the letter which decision you appeal and the change you request. The appeal must have been received by the Authority for Privacy Protection no later than three weeks from the day you received the decision. If the appeal has been received at the right time, the Authority for Privacy Protection will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain any privacy-sensitive personal data or information that may be covered by confidentiality. The authority's contact information is shown in the first page of the decision.