1(3)
Notice: This document is an unofficial translation of
the Swedish Authority for Privacy Protection’s
decision.
COMPLAINANT
See appendix
DATA CONTROLLER
Swedish ref no: Klarna Bank AB
IMY-2023-16584
German ref no:
LDA-1085.2-3115/19-A
IMI case register: Decision under the General Data
164549
Date of the decision:
Protection Regulation – Klarna Bank
2024-04-23
AB
Decision of the Swedish Authority for Privacy Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB (Klarna)
(organizational no 556737-0431) has failed to fulfil its obligations under articles 12(3)
and 17 of the General Data Protection Regulation (GDPR)1 by not handling the
complainant’s request for erasure according to article 17, dated the 19 October 2020,
until the 21 August 2021.
IMY closes the case.
Presentation of the supervisory case
IMY has initiated supervision against Klarna in order to investigate whether Klarna has
dealt with the current complainant’s erasure request pursuant to Article 17 of the
GDPR within the time limit laid down in Article 12(3) of the GDPR. The complaint was
transferred from the supervisory authority of the Member State where the complainant
lodged his complaint (Germany) in accordance with the provisions of the GDPR on
cooperation in cross-border processing. IMY has handled the case as responsible
supervisory authority for the company’s operations pursuant to Article 56 of the GDPR.
The case has been handled through written procedure. Klarna has been given the
opportunity to give its opinion on IMY:s proposed draft decision. Since the complaint
relates to cross-border processing, IMY has used the mechanisms for cooperation and
consistency regulated in Chapter VII of the GDPR. The supervisory authorities
concerned have been the data protection authorities in Germany, Hungary, Denmark,
Postal address:
Austria, Italy, Finland and Poland.
Box 8114
104 20 Stockholm
The complainant has stated, in essence, the following. On 19 October 2020, he/she
Website:
asked Klarna to send him/her an extract from the register of the personal data
www.imy.se
processed about him/her (request for access) and a request for the company to erase
E-mail:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telephone: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16584 2(3)
Datum: 2024-04-23
their personal data. The request for access was processed in a timely manner, but the
erasure request was not answered until 21 November 2020.
Klarna has stated the following. Klarna received the complainant’s request for erasure
on 20 October 2020 and carried out the erasure process on 13 August 2021. The
delay has been due to a misunderstanding by an individual case worker in a context
where the complainant had several requests pending. The case is several years old,
and Klarna has invested considerable resources since then in improving its work,
which is also reflected in the fact that the number of complaints has decreased
considerably. Klarna has already complied with the data subject's request. Against this
background, a sanction for a possible deficiency under the Regulation is not
appropriate, necessary nor proportionate.
Applicable provisions, etc.
It follows from Article 57(1)(f) of the GDPR that IMY shall handle complaints lodged by
a data subject who consider that their personal data is being processed in a manner
contrary to the Regulation and investigate, to the extent appropriate, the subject matter
of the complaint.
According to article 17 of the GDPR, the controller is obliged to erase personal data
without undue delay if one of the conditions set out in the article is met.
Article 12(3) states the following. The controller shall provide information on action
taken on a request under Articles 15 to 22 to the data subject without undue delay and
in any event within one month of receipt of the request. That period may be extended
by two further months where necessary, taking into account the complexity and
number of the requests. The controller shall inform the data subject of any such
extension within one month of receipt of the request, together with the reasons for the
delay.
Assessment of IMY
It is apparent from the investigation that the parties agree that the complainant’s
request for erasure was complied with more than one month after the request was
received. It does not appear that the request was of a particularly complex nature. Nor
does it appear that Klarna informed the complainant of the delay in accordance with
Article 12(3) of the GDPR. IMY therefore considers that Klarna failed to fulfil its
obligation under Article 12(3) by complying with the applicant’s request dated 19
October 2020 only on 21 August 2021.
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16584 3(3)
Datum: 2024-04-23
Choice of corrective measure
Within the scope of the corrective powers, IMY shall take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.2
It follows from Article 58(2) and Article 83(2) of the GDPR that the IMY has the power
to impose administrative fines pursuant to Article 83 of the GDPR. In the case of a
minor infringement, the IMY may, as stated in recital 148 of the GDPR, instead of
imposing a pecuniary penalty, issue a reprimand pursuant to Article 58(2)(b). Account
must be taken of aggravating and mitigating circumstances of the case, such as the
nature, severity and duration of the infringement as well as previous relevant
infringements.
IMY notes the following relevant circumstances. The supervision in question covers
Klarna's handling of an individual complainant's request for erasure in light of the
requirements set out in Article 12(3) of the GDPR. In that regard, IMY has found that
Klarna has failed in its obligations to comply with the right in due time. The prescribed
time limit of a maximum of one month has been exceeded by more than 8 months.
However, the complainant's right to erasure has been fulfilled. The deficiency is
therefore of a less serious nature than if the request had been left unanswered. In
addition, the request had already been met long before IMY contacted Klarna with
questions about the complaint in question. Furthermore, the breach was not
intentional, but was mainly due to an individual mistake by an employee in the internal
case management. IMY considers that the deficiency in question has not had serious
consequences for the complainant.
In an overall assessment of the circumstances surrounding the infringement found,
IMY finds that there is no reason to use the corrective powers in the present case.
The case shall therefore be closed.
This decision has been taken by decision making officer after
presentation by legal advisor .
Appendix
The complainant’s personal data
2 Recital 129 in the GDPR.