1(3)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection’s decision
2023-08-24, no. DI-2021-10388. Only the Swedish
version of the decision is deemed authentic.
Ref no:
DI-2021-10388 Decision under the General Data
IMI case no. 164557
Protection Regulation – Klarna Bank
Date of decision:
2023-08-24 AB
Date of translation:
2023-08-25
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has now
complied with the complainant’s request for deletion. Against this background, the
Swedish Authority for Privacy Protection finds no reason to take further action in the
case.
The case is closed.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision against
Klarna Bank AB (Klarna or the company) due to a complaint. The complaint has been
submitted to IMY as responsible supervisory authority pursuant to Article 56 of the
General Data Protection Regulation (GDPR).1 The handover has been made from the
supervisory authority of the country where the complainant has lodged their complaint
(Germany) in accordance with the provisions of the GDPR on cooperation in cross-
border processing.
The case has been handled through written procedure. In the light of the complaint
relating to cross-border processing, IMY has used the mechanisms for cooperation
and consistency contained in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Germany, Denmark, Finland,
Italy, Poland and Austria.
Complaint
The complainant has mainly stated that Klarna continued to send him e-mails even
Postadress:
Box 8114
though he requested erasure of his personal data.
104 20 Stockholm
Webbplats:
www.imy.se
E-post:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to he processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: DI-2021-10388 2(3)
Datum: 2023-08-25
What Klarna has stated
In its opinion to IMY, Klarna Bank AB stated, inter alia, that the company will erase the
complainant’s personal data. In a second opinion, Klarna confirmed that the erasure of
the complainant’s personal data has been completed.
Statement of reasons for the decision
The complainant has requested the erasure of his personal data. The right to erasure
derives from Article 17 of the GDPR. The provision implies that in certain cases, data
subjects have the right to have their personal data erased without undue delay.
Klarna has stated that the company has now erased the complainant’s data. IMY has
no reason to question this. IMY concludes that Klarna has now complied with the
complainant’s request for deletion. Against this background, IMY finds no reason to
take any further action in this case.
The case is closed.
This decision has been approved by the specially appointed decision-maker
after presentation by legal advisor .
Integritetsskyddsmyndigheten Diarienummer: DI-2021-10388 3(3)
Datum: 2023-08-25
How to appeal
If you want to appeal the decision, you should write to the Swedish Authority for
Privacy Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Swedish Authority for Privacy
Protection no later than three weeks from the day you received the decision. If the
appeal has been received at the right time, the Swedish Authority for Privacy
Protection will forward it to the Administrative Court in Stockholm for review.
You can e-mail the appeal to the Swedish Authority for Privacy Protection if it does not
contain any sensitive personal data or information that may be subject to
confidentiality. The authority’s contact information is shown on the first page of the
decision.