Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s final decision. Only the Swedish version is authentic. 1(7)
COMPLAINANT
See annex
CONTROLLER
Klarna Bank AB
Swedish reference number:
DI-2022-1665 Final decision pursuant to Article 60
Austrian reference number: under the General Data Protection
D130.763
IMI case register:
Regulation – Klarna Bank AB
334404
Date:
2025-03-10
Decision of the Swedish Authority for Privacy
Protection
The Swedish Data Protection Authority finds that Klarna Bank AB (organisation
registration number 556737-0431) has failed in its responsibilities under
• Article 12(2) of the GDPR1 by, when the complainant submitted a request of
access under Article 15 of the GDPR to Klarna Bank AB:s customer service
(in Sweden and then Germany) on August 14th 2021, directing the
complainant to submit a new data subject rights request to the customer
service of the correct country (Austria).
• Article 12(3) of the GDPR by not complying with the complainant’s data
subject rights request dated August 14th 2021 until February 16th 2022.
Klarna Bank AB has therefore neighter facilitated the complainant’s exercise of their
right of access under Article 15 of the GDPR in accordance with Article 12(2) of the
GDPR in connection with the complainant’s request of August 14th 2021, nor satisfied
the complainant’s right of access without undue delay in accordance with Article 12(3)
of the GDPR.
The Swedish Authority for Privacy Protection notes on the other hand that it is not
apparent from the investigation in the case that Klarna Bank AB has failed to comply
with Article 15 of the GDPR in the way alleged in the complaint.
The Swedish Data Protection Authority issues Klarna Bank AB a reprimand pursuant
to Article 58(2)(b) of the GDPR for the infringements of the Articles 12(2) and 12(3) of
Postal address: the GDPR.
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
+46 (8) 657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: DI-2022-1665 2(7)
for Privacy Protection Date: 2025-03-10
Presentation of the supervisory case
The handling of the case
The Swedish Data Protection Authority (IMY) has initiated a supervision against Klarna
Bank AB (Klarna) due to a complaint. The complaint has been submitted to IMY, as
lead supervisory authority pursuant to Article 56 of the GDPR. The handover has been
made from the supervisory authority of the country where the complaint has been
lodged (Datenschutzbehörde, Austria) in accordance with the provisions of the GDPR
on cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authorities have been the data protection authorities in Austria, Norway, Germany,
France, Italy, Denmark and Finland.
In response to the complaint, IMY has initiated a supervision in order to investigate
whether Klarna has facilitated the exercise of the complainant’s right of access under
Article 15 of the GDPR in accordance with Article 12(2) of the GDPR without undue
delay in accordance with Article 12(3) of the GDPR. Furthermore, IMY has initiated the
supervision in order to investigate whether the complainant’s requests for information
and access have been properly received and handled (Article 13(1)(c) and
Article 15 of the GDPR).
In view of the fact that a further investigation in the matter of Article 13(1)(c) would not
be appropriate under Article 57(1)(f) of the GDPR, IMY has decided to only further
investigate the complaint in the matter of the Articles 12 and 15 of the GDPR.
The complaint
The complainant has essentially stated the following. The complainant has submitted a
request of access under Article 15 of the GDPR to Klarna on August 14th 2021. The
reply that he has received from Klarna on August 25th 2021 did not contain the
information he had requested, but only information about Klarna’s general principles of
data protection on the internet. Therefore Klarna has not facilitated his exercise of his
right of access under Article 15 of the GDPR.
What Klarna has stated
Klarna is the data controller for the processing in question and has essentially stated
the following.
Measures taken by Klarna
On August 14th 2021, the complainant, a customer of Klarna in Austria, submitted a
request of access under Article 15 of the GDPR, which was received by Klarna’s
Swedish customer service. Due to the fact that the complainant’s request was written
in German, the case has been transferred to Klarna’s German customer service
department (the German General Customer Service).
On August 25th 2021, one of Klarna’s case handlers at the German General Customer
Service has sent a reply to the complainant’s request by email. In this reply, the
responsible case handler has, inter alia, attached a link to a page with general data
Swedish Authority Our ref.: DI-2022-1665 3(7)
for Privacy Protection Date: 2025-03-10
protection information at Klarna’s German customer service department for data
protection (the German Data Protection Department).
It is likely that the Klarna case handler has directed the complainant to the German
Data Protection Department due to an oversight when the case handler found that the
complainant’s request was written in German. When the error was discovered, another
case handler from the General German Customer Service has sent a new reply to the
complainant on the following day, August 26th 2021. In this new reply from the German
General Customer Service, the relevant contact details to Klarna’s Austrian data
protection customer service department (the Austrian Data Protection Department) has
been attached.
What Klarna has stated regarding compliance with Article 12 and 15 in the
present case
On the basis of the provisions of Article 12(2) of the GDPR, it has not been clear at the
time of the complaint what it means in more detail that the controller must facilitate the
exercise of the data subject’s rights. Nor has there been any EU-guidelines or
guidance decisions in this area at the time. The information that has been available at
the time has however been guidelines issued by the Irish Data Protection Authority in
2019 stating that a controller may invite or redirect a data subject who has made a
data subject rights request (DSR request(s)), made pursuant to Articles 15–22 GDPR,
to send it via a dedicated form instead.2
On August 26th 2021, the German General Customer Service case handler has
facilitated exercising the complainant’s DSR request by providing clear information to
him on the procedure to be followed. The case handler has also provided him contact
details to the Austrian Data Protection Department in order to ensure that his DSR
request would be handled in the best and most efficient way and in accordance with
best practice in Austria. Klarna has been accommodating by handling the
complainant’s DSR request in August 2021. Klarna’s conduct at the time has therefore
been compliant with Article 12(2) and (3) of the GDPR.
In addition, despite previous handling, Klarna sent a a copy of the complainant’s
personal data undergoing processing to the complainant on February 16th 2022.
What Klarna has stated regarding their work to safeguard the data subject's
rights in compliance with Article 12
Since the case in question was handled at Klarna, the European Data Protection
Board (EDPB) has, inter alia, developed guidelines on how a DSR request should be
handled by a controller. Although the guidelines had not been published at the time of
the complaint, Klarna has — both before the case in question and continuously
afterwards — improved, simplified and streamlined their processes to ensure the data
subjects’ rights under the GDPR. Of relevance to the case at hand is that according to
the new routines at Klarna today, it does not matter which customer service a DSR
request is sent to, meaning to which country's customer service a customer turns.
Klarna will today forward such a request internally to the right country's customer
service instead of redirecting the customer to contact that customer service him- or
herself.
2 An Coimisiún um Chosaint Sonraí – Data Protection Commission. Data Subject Access Requests – FAQs. (2019).
https://www.dataprotection.ie/sites/default/files/uploads/2019-10/FAQ%20Guide%20to%20Data%20Subj
ect%20Access%20Requests_Oct19.pdf (Downloaded 2024-10-17)
Swedish Authority Our ref.: DI-2022-1665 4(7)
for Privacy Protection Date: 2025-03-10
Opinion of the complainant
On January 24th 2024 the complainant has been heard on Klarna's statement. The
complainant has on January 31st 2024 essentially stated the following. It is possible
that Klarna has processed his request. In any event, he has not received an answer in
the sense of information at any time. He has not been under any obligation to contact
the correct customer service office once he has turned to Klarna. Klarna has therefore
not acted in accordance with Article 12(2) of the GDPR in that regard, since Klarna
should have forwarded his request to the correct customer service.
It is not true that he received a copy of his personal data undergoing processing by
Klarna on February 16th 2022.
Opinion of Klarna
On November 15th 2024 Klarna was heard on the complainant’s opinion. On
November 19th 2024 Klarna has stated the following. Klarna has sent the complainant
a copy of his personal data undergoing processing by Klarna on February 16th 2022. In
support of Klarna’s statement on that point, Klarna has adduced the email
correspondence that Klarna had with the complainant from February 16th 2022.
Opinion of the complainant
IMY sent the submissions of Klarna from November 19th 2024 to the Austrian Data
Protection Authority Datenschutzbehörde on January 17th 2025 asking to communicate
them to the complainant, to grant the right to be heard, with a time frame on 14 days
and then come back to IMY, preferably no later than February 14th 2025. The Austrian
Data Protection Authority did not revert to this.
Motivation for the decision
Applicable provisions
The controller shall facilitate the exercise of the data subject’s rights under the
Articles 15 to 22 of the GDPR. (Article 12(2) of the GDPR)
The controller shall provide information on action taken on a request under the Articles
15 to 22 of the GDPR to the data subject without undue delay and in any event within
one month of receipt of the request. That period may be extended by two further
months where necessary, taking into account the complexity and number of the
requests. The controller shall inform the data subject of any such extension within one
month of receipt of the request, together with the reasons for the delay. (Article 12(3)
of the GDPR)
It further follows from Article 15 of the GDPR that the data subject has the right to
obtain from the controller confirmation as to whether or not personal data concerning
him or her are being processed and, where that is the case, access to the personal
data and certain specified information (right of access). (Article 15 of the GDPR)
It further follows from Article 57(1)(f) of the GDPR that IMY must process complaints
from data subjects who consider that their personal data are being processed in
breach of the GDPR. IMY is to examine, where appropriate, the subject matter of the
Swedish Authority Our ref.: DI-2022-1665 5(7)
for Privacy Protection Date: 2025-03-10
complaint. The Court of Justice of the European Union has stated that the supervisory
authority must investigate such complaints with due diligence.3
Under 23 § of the Administrative Procedure Act4, an authority must ensure that a case
is investigated to the extent required by its nature.
Assessment
The case
The investigation has shown that, at the time of the complaint, it was up to the data
subject to resend a request for rights under Article 15 of the GDPR to the Klarna
customer service of the country in which the data subject was resident, if the request
was made to another country's customer service.
Legal provisions
Article 12(2) of the GDPR: facilitation of the exercise of data subject rights
It is true that, at the time of the complaint, there were no indicative clarifications
provided by the EDPB clarifying what it means for the controller to facilitate the
exercise of data subject rights. From the guidelines issued by the Irish Data Protection
Authority in 2019 it has been said that in case of a received DSR request, it has been
sanctioned that a controller or a processor invites or redirects a data subject to a more
appropriate communication channel for the controller or the processor. Today, the
legal position is clearer. Where a data subject makes a DSR request using a
communication channel provided by the controller, the request of the data subject shall
be handled, even if the controller prefers another channel.5
The meaning of the obligation to facilitate the exercise of, inter alia, a data subject’s
right of access under Article 15 of the GDPR has however already been elaborated in
recital 59 of the GDPR at the time of the complaint. Recital 59 of the GDPR states that
the controller should establish procedures to facilitate the exercise of data subject
rights, including mechanisms for requesting and, where appropriate, accessing
personal data free of charge.
For example, a controller is not considered having facilitated the exercise of the rights
of a data subject in accordance with Article 12(2) of the GDPR where a data subject
needs to delete his or her user account and create a new one in order to exercise the
DSR in question.6 It is therefore the responsibility of the controller to facilitate the
exercise of the data subject's rights by not requiring time-consuming further action
from the data subject, like demanding the data subject to make a new DSR request to
another e-mail address.
Furthermore, it is IMY’s opinion that the EDPB Guidelines 01/2022 show broad support
for interpreting, on the basis of Article 12(2) and recital 59 of the GDPR, that facilitation
should not mean to require additional measures like those in this case. Klarna’s
argumentation that the EDPB Guidelines on access were not published at the time of
the present case does not call that finding from IMY into question. IMY does not claim
3 Judgment in Schrems II, Case C-311/18, EU:C:2020:559, paragraph 109.
4 The Swedish Administrative Procedure Act (2017:900)
5 Stockholm Administrative Court of Appeal judgment of 7 June 2024 in case No 2639-23 and European Data
Protection Board, (EDPB or European Data Protection Board (2023) Guidelines 01/2022 on data subject rights –
Right of access (EDPB Guidelines 01/2022), p. 52 et seq.
6 Judgment of the Stockholm Administrative Court of Appeal of 7 June 2024 in case number 2639-23
Swedish Authority Our ref.: DI-2022-1665 6(7)
for Privacy Protection Date: 2025-03-10
that Klarna has been obliged to follow guidelines that were not available at the time of
the complaint.7
Although there has not been any guidelines on Article 12(2) of the GDPR at the time of
the complaint, there has still been an obligation for a controller to ensure that internal
processes and systems have been in compliance with the provisions of the GDPR.8 By
requesting the complainant to make a new DSR request to another recipient, Klarna
has not facilitated the complainant’s exercise of its right of access under Article 15 of
the GDPR. In conclusion, IMY therefore finds that the requirements to facilitate the
exercise of the data subject rights according to Article 12(2) of the GDPR has not been
met at the time of the handling of the case by Klarna. Overall, therefore, IMY therefore
concludes that Klarna has failed to fulfil its obligations under Article 12(2) of the GDPR.
Article 12(3) of the GDPR: time period for the provision of information
Based on what Klarna has stated in the case, the complainant's request has been
handled on August 26th 2021, which the complainant has not objected to. The
investigation has however shown that the complainant's request for access was not
satisfied until February 16th 2022, which is more than one month after the request was
received. It does not appear like the request has been of a particularly complex nature.
Neither does it appear like Klarna has informed the complainant of the delay with a
justification of an extended response time of two months in total in accordance with
Article 12(3) of the GDPR. IMY therefore concludes that Klarna has failed to fulfil its
obligations under Article 12(3) of the GDPR by not satisfying the complainant's request
until February 16th 2022.
Article 15 of the GDPR: right of access
The complainant has disagreed that his request for access has been satisfied. IMY
has asked Klarna to submit written evidence that the complainant’s request for access
has been satisfied. Klarna has by their submissions showed that the complainant's
request for access has been satisfied, but not until February 22nd 2022. The
complainant was then given the opportunity to comment on Klarna's statement.
IMY has not received any information from the complainant that contradicts these facts
and finds no other reason to question the submissions from Klarna. IMY has therefore
investigated the case to the extent required by Article 57(1)(f) of the GDPR and 23 § of
the Administrative Procedure Act and notes that it is not apparent from the
investigation that Klarna has failed to comply with Article 15 of the GDPR in the way
alleged in the complaint.
Choice of corrective measure
Pursuant to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83 of the GDPR. Depending on
the circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2) of the GDPR, such as
injunctions and prohibitions. Furthermore, Article 83(2) of the GDPR determines the
factors to be considered when imposing administrative fines and when determining the
amount of the fine. In the case of a minor infringement, IMY may, as stated in recital
148 of the GDPR, instead of imposing a fine, issue a reprimand pursuant to Article
58(2)(b) of the GDPR. Aggravating and mitigating circumstances of the case need to
7 See Stockholm Administrative Court’s judgment of 22 December 2022 in case number 11453-22
8 Judgment of the Stockholm Administrative Court of Appeal of 7 June 2024 in case number 2639-23
Swedish Authority Our ref.: DI-2022-1665 7(7)
for Privacy Protection Date: 2025-03-10
be taken into consideration. These could include the nature, gravity and duration of the
infringement as well as past infringements of relevance.
IMY has considered the following relevant facts. The current supervision covers
Klarna’s handling of an individual complainant’s request for access. In that regard, IMY
found that Klarna failed to fulfil its responsibilities under Article 12(2) of the GDPR by
failing to facilitate the complainant’s request for access under Article 15 of the GDPR
and its responsibilities under Article 12(3) of the GDPR by failing to deal with the
complainant’s request without undue delay.
Mitigating the infringement under Article 12(2) of the GDPR, it should be taken into
account that Klarna has taken measures to facilitate the exercise of data subject rights
under the GDPR through changes in their procedures. Some measures have already
been taken before the opening of this supervisory case. As Klarna's procedures stand
today, Klarna internally ensures that a received DSR request is sent to the right
country's customer service, regardless of which customer service the request was sent
to from the beginning, without the complainant having to make any new request.
Furthermore, the identified infringement under Article 12(2) of the GDPR has occurred
relatively far back in time (2021).
The current supervision also covers Klarna’s handling of an individual complainant’s
request for access in the light of the requirements set out in Article 12(3) of the GDPR.
In this regard, IMY has found that Klarna has failed to fulfil its obligations to satisfy the
complainant’s request in a timely manner. Although the prescribed time limit of a
maximum of one month has been exceeded by more than six months, the fact that the
complainant’s right of access has been complied with may be considered in relation to
the infringement under Article 12(3) of the GDPR. The infringement in question is
therefore of a less serious nature than if the request had been left unanswered.
Against this background, IMY considers this a minor infringement within the meaning
of recital 148 of the GDPR and that Klarna is to be given a reprimand pursuant to
Article 58(2)(b) of the GDPR.
Annex
The complainant’s personal data