1(4)
Registration number IMY-
Decision pursuant to Article 60 under
2023-3161
Case 164549 Complaint, LDA-
521.13778 / 631.298 the General Data Protection
Date of decision
2024-04-22
Regulation — Klarna Bank AB.
Decision of the Swedish Authority for Privacy
Protection (IMY)
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB has now
complied with the complainant’s request for deletion (erasure). Against this
background, the Swedish Authority for Privacy Protection finds no reason to take any
further action in the case
The case is closed.
Report on the supervisor
The Swedish Authority for Privacy Protection (IMY) has initiated supervision against
Klarna Bank AB (Klarna or the company) in response to a complaint lodged on 2
December 2020. The complaint has been submitted to IMY, as the lead supervisory
authority for the company’s activities under Article 56 of the of the General Data
Protection Regulation (GDPR)1. The transmission has been made by the supervisory
authority of the country where the complainant lodged his complaint (Germany, Berlin)
where the complainant has lodged their complaint in accordance with the GDPR’s
provisions on cooperation in cross-border processing.
The investigation in the case has been carried out through written correspondence.
Since this is a complaint relating to cross-border processing, IMY has used the
mechanisms for cooperation and consistency contained in Chapter VII GDPR. The
supervisory authorities concerned has been the data protection authorities in
Denmark, Germany, Hungury, Finland, Italy, Norway, Poland and Austria.
What the complainant has stated
Postadress: The complaint shows, in essence, the following: The applicant has approached Klarna
Box 8114 and asked it to stop sending SMS messages to it concerning someone else’s invoice
104 20 Stockholm from Klarna. The complainant has never been a customer of Klarna. On 11 November
Webbplats: 2020, Klarna replied to the applicant that it could not erase the applicant’s telephone
www.imy.se number because another customer had indicated the applicant’s telephone number as
E-post:
[email protected]
1Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-3161 2(4)
Datum: 2024-04-22
its own. Klarna was not in a position to investigate which customer indicated the
applicant’s telephone number as his own and could not therefore delete it either.
Klarna instead asked complainants to block Klarna’s number, in order to avoid
receiving SMS messages from Klarna regarding the other customer’s invoices.
What Klarna has stated
Klarna states, in essence, as follows. The reply from Klarna sent on 11 November
2020 was in relation to the complainant’s request of 9 November 2020 not to receive
communications from Klarna. Klarna’s reply shows that another customer has probably
indicated the phone number as their own and that the customer service employee
cannot change another customer’s data. The complainant has been asked to block the
number from which the reminders were sent.
The only request for deletion received by Klarna from the complainant is a request for
deletion made on 29 September 2021. In connection with that request, Klarna carried
out an investigation and concluded that another customer had incorrectly indicated the
complainant’s telephone number on 4 October 2021, Klarna corrected the second
customer’s number so that the complainant’s number was deleted according to the
request.
Klarna wishes to point out that the telephone number stored at the company has been
indicated by another customer as its own phone number. Klarna’s terms and
conditions state that a customer must always provide their own personal data. Klarna
wishes to point out that the company has developed its products since the time of the
complaint, which has resulted in that the events described above can no longer take
place because verification with SMS code is now required.
Justification of the decision
Assessment of the Swedish Authority for Privacy Protection (IMY)
It is apparent from the investigation in the case that the complainant contacted Klarna
on 9 November 2020 and requested the company to delete the applicant’s telephone
number so that it would not receive SMS messages with reminders of unpaid invoices
at Klarna which did not concern the complainant. The right to erasure derives from
Article 17 of the GDPR. The provision provides that the data subject shall have the
right to have his or her personal data erased from the controller without undue delay
and that the controller shall be obliged to erase personal data without undue delay if
they are no longer necessary for the purposes for which they have been collected or
otherwise processed.
It is apparent from the investigation in the case that, at the time when the complainant
contacted it on 9 November 2020, Klarna could not find the customer who incorrectly
indicated the complainant’s telephone number as his own and could not therefore
delete the complainant’s number. However, it appears from the investigation in the
case that, on 29 September 2021, the complainant again requested erasure and that,
on that occasion, Klarna had the opportunity to correct the other customer’s telephone
number so that the complainant’s telephone number could be deleted as requested.
Klarna has further stated that the company has developed its products since the time
of the complaint, which has resulted in that the events described above can no longer
take place because verification by SMS code is now required.
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-3161 3(4)
Datum: 2024-04-22
IMY finds no reason to call into question the fact that Klarna deleted the complainant’s
telephone number. IMY notes that Klarna has now satisfied the complainant’s right to
erasure. In the light of the above, IMY finds no reason to take any further action in this
case.
The case should therefore be closed.
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-3161 4(4)
Datum: 2024-04-22
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.