1(6)
Swedish ref. no.
DI-2021-10063 Final decision pursuant to Article 60
IMI case register: under the General Data Protection
164557
Date:
Regulation – Klarna Bank AB
2024-11-16
Decision of the Privacy Protection Authority
The Swedish Data Protection Authority (IMY) finds that Klarna Bank AB (556737-0431)
has processed the complainant’s personal data in breach of Article 12(3) of the
General Data Protection Regulation1 (GDPR) by failing to to provide the complainant
access to their personal data without undue delay.
IMY issues a reprimand to Klarna Bank AB pursuant to Article 58(2)(b) of the GDPR
for the breach of Article 12(3).
Presentation of the supervisory case
Proceedings
The Privacy Protection Authority has initiated supervision regarding Klarna Bank AB
(Klarna or the company) due to a complaint dated 20 March 2020. The complaint has
been submitted to IMY, as lead supervisory authority pursuant to Article 56 of the
GDPR. The handover has been made from the supervisory authority of the country
where the complaint has been lodged (Germany) in accordance with the provisions of
the GDPR on cooperation in cross-border processing.
The supervision has been initiated in order to investigate whether the complainant’s
request for access has been properly received and handled (Article 15 GDPR),
whether the complainant’s request for erasure has been properly received and
handled (Article 17 GDPR) and whether the complainant’s requests for access and
erasure have been handled within the statutory time limits (Article 12 GDPR).
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
Postal address: consistency contained in Chapter VII of the GDPR. The concerned supervisory
Box 8114 authorities have been the data protection authorities in Germany, Denmark, Austria,
104 20 Stockholm Italy, Poland and Finland.
Website:
www.imy.se
E-mail:
[email protected] 1
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
The Privacy Protection Authority Reference number: DI-2021-10063 2(6)
Date: 2024-11-16
The complaint
The complainant has primarily stated that on 20 December 2019, he unsuccessfully
requested access to and erasure of his personal data. Klarna has instead on 5
February 2020 referred him to submit his request for deletion to
[email protected] and referred to their application for further information. The
complainant contacted Klarna on 6 February 2020 stating that he had not been able to
find the information he was looking for and reiterating his request for access. The
complainant also sent a reminder to Klarna on 8 March 2020. Despite repeated
contact with Klarna, the company has not complied with his requests for access and
deletion.
What Klarna has stated
Klarna has essentially stated the following. Klarna’s dispute resolution team contacted
the complainant by email on 20 December 2019 regarding an order paid by the
complainant with Klarna where the complainant received faulty goods. On the same
day, the complainant replied to the abovementioned email concerning the dispute and,
in the same email, submitted requests for access and for erasure. Due to a large
number of cases, Klarna initially missed that the complainant’s message also
contained a request for access or deletion. As soon as Klarna discovered this, they
contacted the complainant on 5 February 2020 and referred him to submit his request
for access and deletion respectively to [email protected].
The complainant never returned any request to [email protected]. Instead, the
complainant contacted Klarna's dispute resolution team and later also their customer
service to remind them of his request. Klarna then initiated a process to verify the
identity of the complainant. As they did not have all the necessary identification points
according to the procedure in place at the time, it took until 9 August 2023 for them to
be able to comply with the complainant’s request for access. The complainant had
then informed Klarna that he would wait until further notice to delete his data.
Klarna notes a posteriori that, at the time of the first contact on 20 December 2019, the
complainant could have been identified with the information provided by the
complainant at that time, with the proviso that the email address used by the
complainant at the time of the purchase should have been confirmed first.
Since the time of the complainant’s first contact, Klarna has been working on
improving their processes to ensure rights under the GDPR. Among other things, the
company has reduced its processing times and now handles requests for access
regardless of the channel through which it has been received. The company has also
updated its identification routine so that e-mail confirmations are no longer needed
when Klarna can confirm that the e-mail address that the complainant contacted
Klarna via is the same as used for purchases by the complainant.
Communication in the case
IMY has communicated Klarna’s reply to the relevant national supervisory authority in
the country where the complainant lodged the complaint. The German data protection
authority has indicated that the complainant did not wish to comment on the response
of the supervised entity due to the lengthy processing time.
The Privacy Protection Authority Reference number: DI-2021-10063 3(6)
Date: 2024-11-16
Reasons for the decision
Applicable provisions, etc.
It follows from Article 15 of the GDPR that the data subject has the right to obtain from
the controller confirmation as to whether or not personal data concerning him or her
are being processed and, if so, access to the personal data and certain specified
information.
It follows from Article 17 of the GDPR that the controller is obliged to delete personal
data without undue delay if one of the conditions set out in that article is met.
According to Article 12(3): Upon request, the controller shall, without undue delay and
in any event no later than one month after receiving the request, provide the data
subject with information on the measures taken pursuant to Articles 15 to 22. That
period may be extended, if necessary, by a further two months, taking into account the
complexity of the request and the number of requests received. The controller shall
notify the data subject of such an extension within one month of receipt of the request,
stating the reasons for the delay.
The European Data Protection Board (EDPB) Guidelines 01/2022 on access state that
the calculation of the one-month deadline in Article 12(3) is calculated from the date of
receipt of the request. Where, upon receipt of the request, the controller needs to take
measures to ensure the identity of the data subject, the time limit may be suspended
until the controller has received the information necessary to identify the data subject.
provided that the request for additional information has been made without undue
delay. The guidelines further state that if a data subject makes a request using a
communication channel provided by the controller, the controller must handle such a
request, even if the controller prefers another channel.2
IMY’s assessment
Right of access
IMY notes that the GDPR does not lay down any formal requirements as to how a
request for access under Article 15 is to be made and that there are therefore, in
principle, no requirements under the GDPR that data subjects must observe when
choosing the communication channel they use to contact the controller. In this case,
the data subject has contacted Klarna directly with a clear request for access on 20
December 2019. Klarna only discovered the complainant’s request on 5 February
2020. IMY considers that the action taken by Klarna at that time, referring the
complainant to their email address [email protected], was not sufficient to
satisfy the complainant’s request. Furthermore, the measure was not taken within the
time frame laid down by the GDPR.
Furthermore, the investigation shows that Klarna did not respond to the complainant’s
request for access until 9 August 2023. It does not appear that the complainant’s
request was particularly complex. Klarna also stated that, at the time of their first
contact on 20 December 2019, they had sufficient information to verify the
2
European Data Protection Board (EDPB) Guidelines on the right of access - Guidelines 01/2022 on data subject
rights – Right of access, version 2.0, adopted on 28 March 2023, paragraphs 52-53 and 159.
The Privacy Protection Authority Reference number: DI-2021-10063 4(6)
Date: 2024-11-16
complainant’s identity. IMY therefore finds no reason to extend the time limit of one
month in Article 12(3).
In an overall assessment, IMY considers that Klarna has processed the complainant’s
personal data in breach of Article 12(3) by not giving the complainant access to his
personal data without undue delay.
Right to erasure
From the information provided by Klarna, it appears that the complainant no longer
asserts his request for erasure. The complainant has been given the opportunity to
comment on what Klarna has put forward but has refrained from commenting on the
information. IMY therefore considers that there is no deficiency under Article 17 of the
GDPR.
Choice of intervention
IMY has found above that Klarna has failed to fulfil their obligations under Article 12(3)
of the GDPR. The last question to be considered by IMY is what action should be
taken in response to the infringement.
In the event of infringements of the GDPR, IMY has a number of corrective powers,
including reprimands, injunctions and fines. It follows from Article 58(2)(a) to (j) of the
GDPR. According to recital 129 of the GDPR, IMY must take such measures as are
appropriate, necessary and proportionate to ensure compliance with the GDPR.
According to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances of the case need to be taken into consideration. These could include
the nature, gravity and duration of the infringement as well as past infringements of
relevance.
IMY notes the following relevant facts. The investigation is based on an individual
complaint and concerns shortcomings in the processing of data relating to an
individual data subject. There has been no question of the processing of sensitive
personal data. The prescribed time limit of a maximum of one month has been
exceeded by more than 3 years and 7 months. However, the complainant’s right of
access has been granted. The deficiency in question is therefore of a less serious
nature than if the request had been left unanswered. The investigation shows, among
other things, that the company has updated its procedures for handling requests for
access and now handles the request regardless of the channel through which the
request was received, that the company has reduced its processing time for incoming
cases and that the company has reviewed its identification routine and made it clearer
and more efficient.
Against this background, IMY considers this a minor infringement within the meaning
of recital 148 of the GDPR. In the light of the foregoing, IMY considers that a
The Privacy Protection Authority Reference number: DI-2021-10063 5(6)
Date: 2024-11-16
reprimand is an appropriate, necessary and proportionate measure for the
infringements at issue. The company must therefore be granted a reprimand pursuant
to Article 58(2)(b) of the GDPR.
__________________________
This draft decision has been approved by the decision-maker after a
presentation by the legal advisor .
Annex
Complainant’s personal data
Copy to
Data Protection Officer:
Complainant
The Privacy Protection Authority Reference number: DI-2021-10063 6(6)
Date: 2024-11-16
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.