1(4)
Notice: This document is an unofficial
translation of the Swedish Authority for
Privacy Protection’s decision.
COMPLAINANT
See appendix
Registration number:: DATA CONTROLLER
IMY-2023-16503 Klarna Bank AB
Case register/National
registration number:
CR 134712
521.14296 / 631.370
Date:
Decision under the General Data
2024-09-05
Protection Regulation – Klarna bank
AB
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) notes that it is not apparent from
the investigation in the case that Klarna Bank AB (org. no. 556737-0431) has failed to
comply with1 the GDPR in the manner stated in the complaint.
The case is closed.
Presentation of the supervisory case
The Privacy Protection Authority (IMY) has received a complaint regarding the right to
information pursuant to Article 13 of the GDPR and the right of access pursuant to
Article 15 of the GDPR and initiated supervision of Klarna Bank AB (Klarna or the
Company). The complaint has been submitted to IMY by the supervisory authority of
the country where the complainant lodged its complaint (Germany) in accordance with
the Regulation’s provisions on cooperation in cross-border processing. IMY has dealt
with the complaint as the lead supervisory authority under Article 56 GDPR.
The proceedings at IMY have been carried out by exchange of letters. In view of the
cross-border processing, IMY has made use of the cooperation and consistency
mechanisms provided for in Chapter VII of the GDPR. The relevant supervisory
Postadress: authorities have been the data protection authorities of Germany, Austria, Hungary,
Box 8114 Denmark, Norway, Finland, Italy, the Netherlands, Poland, Ireland, France, Estonia
104 20 Stockholm and Spain.
Webbplats:
www.imy.se
E-post:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telefon: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16503 2(4)
Datum: 2024-09-05
The appellant states, in essence, as follows. By e-mail from Klarna on 13 August 2021,
the complainant received information that a register extract was sent to the
complainant by post. The extract of the register reached the complainant on 17 August
2021. The complainant lacks information on the legal basis for the processing of his or
her personal data and what personal data have been processed.
Klarna states, in essence, the following. On 18 January 2021, Klarna received the
complainant’s request for the personal data processed. At the same time, they
received questions from the complainant concerning the processing of personal data,
but the legal basis is not asked about there. Klarna replied to the other questions put
by the appellant. Klarna further states that if the complainant has further questions
about the processing, the complainant is welcome to contact Klarna again. On 5
February 2021, Klarna referred by e-mail to the extract from the register which, in
accordance with the applicant’s request, was subsequently sent by post to the
applicant on 8 February 2021 for answers to the complainant’s questions. The legal
basis for the processing has been specified in this extract. The appellant has not
returned after that. Klarna has further stated that the legal basis per purpose is set out
in Klarna’s data protection information (including for each recipient).
The appellant has been given the opportunity to comment on Klarna’s reply but has
not submitted observations.
Statement of reasons for the decision
It follows from Article 57(1)(f) of the GDPR that the IMY shall deal with complaints from
data subjects who consider that their personal data are being processed in a manner
contrary to the Regulation. It also follows from that provision that, where appropriate,
IMY must examine the subject matter of the complaint. The CJEU has ruled that the
supervisory authority must investigate such complaints with due care.2
According to Section 23 of the Swedish Administrative Procedure Act (2017:900), an
authority must ensure that a case is investigated to the extent required by its nature.
The right to information derives from Article 13 of the GDPR. Article 13(1)(c) provides
that the data subject has the right to obtain from the controller information about the
purposes of the processing for which the personal data are intended and the legal
basis for the processing. The right of access follows from Article 15 of the GDPR. The
provision means that the data subject shall have the right to obtain from the controller
confirmation as to whether personal data concerning him or her are being processed
and, if so, to have access to the personal data as well as certain supplementary
information, including the purposes of the processing.
In response to the complaint, IMY has put a number of questions to Klarna. IMY then
gave the appellant the opportunity to comment on Klarna’s answer to IMY’s questions.
IMY considers that through these measures the case has been investigated to the
extent required by Article 57(1)(f) of the GDPR and Section 23 of the Swedish
Administrative Procedure Act.
2 Judgment in Schrems II, Case C-311/18, EU:C:2020:559, paragraph 109.
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16503 3(4)
Datum: 2024-09-05
The appellant submits, in essence, that Klarna did not provide information on which
personal data were processed or on the basis of the legal basis on which the personal
data were processed. In the course of the investigation of the complaint in response to
IMY, Klarna stated that it responded to the applicant’s request for access and that,
according to Klarna, the extract of the register sent to the applicant on 8 February
2021 specified the legal basis for the processing. The appellant has been given the
opportunity to comment on Klarna’s statement but has not been heard. IMY finds that it
is not possible to conclude from the investigation in the case that Klarna has failed to
comply with the GDPR on what is claimed in the complaint.
The case should therefore be closed.
__________________________
This decision has been taken by the senior legal advisor , after
presentation by legal advisor, .
Annex
Personal data of the complainant
Copy
The company’s DPO
Integritetsskyddsmyndigheten Diarienummer: IMY-2023-16503 4(4)
Datum: 2024-09-05
How to appeal
If you want to appeal the decision, you should write to the Authority for Privacy
Protection. Indicate in the letter which decision you appeal and the change you
request. The appeal must have been received by the Authority for Privacy Protection
no later than three weeks from the day you received the decision. If the appeal has
been received at the right time, the Authority for Privacy Protection will forward it to the
Administrative Court in Stockholm for review.
You can e-mail the appeal to the Authority for Privacy Protection if it does not contain
any privacy-sensitive personal data or information that may be covered by
confidentiality. The authority’s contact information is shown in the first page of the
decision.