1(4)
Notice: This document is an unofficial translation of the
Swedish Authority for Privacy Protection’s decision 2024-
01-09, no. IMY-2023-8336. Only the Swedish version of the
decision is deemed authentic.
Ref.no
IMY-2023-8336
Final decision pursuant to Article 60 under the
General Data Protection Regulation- Klarna
Date of translation:
2024-01-10 Bank AB
Date of decision:
2024-01-10
Decision of The Swedish Authority for privacy
protection (IMY)
The Swedish Authority for Privacy Protection finds that Klarna Bank AB has processed
personal data in breach of:
• article 12(2) GDPR1 by not facilitating the exercise of the right of rectification
by the complainant under article 16 in accordance with his request of 8th of
June 2020.
• article 16 by not allowing the complainant to change his e-mail address in
accordance with its request of 8th of June 2020.
The Swedish Authority for Privacy Protection issues a reprimand to Klarna Bank AB
pursuant to article 58(2)(b) of the GDPR for breach of articles 12(2) and 16 of the
GDPR.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated a supervision
regarding Klarna Bank AB (Klarna or the company) due to a complaint. The complaint
has been submitted to IMY as the lead supervisory authority under Article 56 GDPR.
The handover has been made from the supervisory authority of the country where the
complainant has lodged his complaint (Germany) in accordance with the provisions of
the GDPR on cooperation in cross border processing.
The case has been handled through written procedure. In the light of the complaint
concerning a cross border processing, IMY has used the mechanisms for cooperation
and consistency contained in chapter VII of the GDPR. The supervisory authorities
Postal address:
concerned have been the data protection authorities in Austria, Hungary, Denmark,
Box 8114
104 20 Stockholm
Germany, Norway, Finland, Italy, the Netherlands, Poland, Ireland, France, Estonia
and Spain.
Website:
www.imy.se
E-mail:
[email protected] 1
Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Registration number: IMY-2023-8336 2(4)
Date: 2024-01-10
The complaint
The complainant has mainly stated the following. The complainant has a Klarna card
and has requested rectification of his email-address connected to the card. Klarna´s
response to the complainant´s request has been that it´s technically not possible to
rectify the email-address and that the complainant therefore has to order a new card in
order to have the data rectified. Ordering a new Klarna card would thus affect the
complainant´s credit score in a negative manner.
What Klarna Bank AB has stated
Klarna Bank AB has mainly stated the following. Klarna is the data controller for the
processing of the data in question. The request for rectification was received by Klarna
on 8th of June 2020 and on 16th of July 2020. The complainants request that was
received by Klarna on 8th of June was handled by a customer service officer, whom
informed the complainant that the data relating to a card that has already been issued
can´t be changed and that the complainant, therefore, needs to order a new card to
have his e-mail address changed. The customer service officer who handled the
complainants request received by Klarna on the 16th of July 2020, informed the
complainant that the email-address for all the current outstanding invoices has been
changed.
It is not possible for the company to rectify data connected to a card that has already
been issued. Since the company uses the email-address to which the customer’s card
is linked as an identification point, and as a part of its verification process, this means
in practice that a new card must be issued in order for the email-address to be
changed.
It is not possible for Klarna to correct the email-address linked to the complainants
Klarna card since the applicant, on 16th of July 2020, requested the deletion of all of his
personal data. The applicant also requested the cancellation of his Klarna card at the
same time.
Statement of reasons for the decision
Applicable provisions, etc.
Pursuant to article 12(2), the controller has an obligation to facilitate the exercise of the
data subject’s rights in accordance with articles 15-22 of the GDPR.
According to article 16 of the GDPR, the data subject shall have the right to obtain
from the controller without undue delay the rectification of inaccurate personal data
concerning him or her. Rectification of personal data may be deemed to mean that the
original, incorrect, personal data is replaced by personal data concerning the correct
circumstances.
According to article 25 of the GDPR the controller shall, taking into account the state of
the art, the cost of implementation and the nature, scope, context and purposes of
processing as well as the risks of varying likelihood and severity for rights and
freedoms of natural persons posed by the processing, both at the time of the
determination of the means for processing and at the time of the processing itself,
implement appropriate technical and organisational measures, such as
Privacy Protection Authority Registration number: IMY-2023-8336 3(4)
Date: 2024-01-10
pseudonymisation, which are designed to implement data-protection principles, such
as data minimisation, in an effective manner and to integrate the necessary
safeguards into the processing in order to meet the requirements of this regulation and
protect the rights of data subjects.
According to article 5 (1) (d) personal data shall be accurate and, where necessary,
kept up to date; every reasonable step must be taken to ensure that personal data that
are inaccurate, having regard to the purposes for which they are processed, are
erased or rectified without delay (principle of accuracy).
Assesment of IMY
When the complainant requested rectification of his email-address on 8th of June 2020,
the company stated that there is no technical possibility of rectifying the data and
therefore asked the complainant to order a new Klarna card. According to Klarna, the
reason for this is that the email-address to which the customer´s card is connected, is
used as an identification point, and as a part of Klarna´s verification process. This
means that the only way to have the email rectified is through the ordering and issuing
of a new card.
According to Article 16, the data subject has the right to rectification of inaccurate
personal data. The responsibility is upon the controller to take action to correct
inaccurate data, when the data subject has made a request upon that, and not upon
the data subject (cf. principle of accuracy in article 5 (1) (d) which also obliges the
controller to rectify inaccurate data on its own initiative). What constitutes inaccurate
personal data and whether or not personal data should be rectified shall be assessed
and determined in relation to the purposes for which the personal data is being
processed. If contact information is used for, for example, communication, it is
necessary for the purpose of the processing such data, that the data is updated.
Requesting the data subject to order a new Klarna card in order to have his email
address rectified was not an acceptable way for the company to fulfil its obligations
under Article 16. IMY therefore concludes that Klarna Bank AB has violated Article 16
of the GDPR by not rectifying the complainant’s personal data.
According to Article 12(2) GDPR, the controller has an obligation to facilitate the
exercise of the data subjects right to rectification under article 16. The meaning of this
obligation is developed in recital 59 which states, inter alia, that procedures should be
laid down to facilitate the exercise of data subjects’ rights, including mechanisms for
requesting and, where appropriate, obtaining rectification. Article 12(2) thus includes
an obligation for the controller to proactively devise solutions that facilitates for the
data subject to exercise his or her rights. The solution offered by Klarna to the data
subject to order a new card, did not enable the data subject to rectify his email-
address.
In the light of Article 5(1)(d) and Article 25 of the GDPR, IMY considers that the
solution offered by Klarna, i.e. the ordering of a new card by the complainant, has
made it difficult for him to exercise his right to rectification. Facilitating for the data
subject to exercise his or her rights, is about having simple and clear means of
communication, that enables that. By referring the complainant to ordering a new card,
because of how the company´s system is designed, has not made it possible for the
complainant to exercise his right. The company can´t deviate from its obligations
under the GDPR by the design of its own systems. On the contrary, as stated above,
the GDPR requires the controller to facilitate the exercise of the data subject’s rights.
Privacy Protection Authority Registration number: IMY-2023-8336 4(4)
Date: 2024-01-10
The company’s explanation that it is not possible to rectify the complainants email-
address, may be considered contrary to this.
IMY therefore finds that Klarna Bank AB has violated Article 12(2) of the GDPR by not
facilitating the exercise of the complainant’s right under Article 16 to have his email-
address corrected.
Choice of corrective measure
It follows from article 58(2) and Article 83(2) of the GDPR that IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or in
place of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be taken into account
when imposing administrative fines and when determining the amount of the fine. In
the case of a minor infringement, IMY may, as stated in recital 148, instead of
imposing a fine, issue a reprimand pursuant to Article 58(2)(b). Account needs to be
taken to the aggravating and mitigating circumstances of the case, such as the nature,
gravity and duration of the infringement as well as past infringements of relevance.
IMY notes the following relevant facts. Klarna has infringed article 16 and article 12(2)
of the GDPR by not complying with or facilitating the complainant’s request for
rectification under article 16. This supervision has concerned the processing of only
one person´s personal data. Klarna has also reconnected to the complainant and
explained why it was not possible for the company to rectify his email-address. In
addition, Klarna has offered the applicant an alternative for having his email-address
corrected. Klarna cannot therefore be regarded as having intended to deny the
complainant the rectification of his email-address.
Against this background, IMY considers that it is a minor infringement within the
meaning of recital 148 and that Klarna Bank AB must be given a reprimand pursuant
to Article 58(2)(b) of the GDPR.
This draft decision has been approved by Head of Unit after
presentation by legal advisor .