1(5)
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
decision.
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Diarienummer:
IMY-2022-10270 Decision under the General Data
Case number at
the German supervisory
Protection Regulation – Klarna Bank
authority
521.16090
AB
IMI case register:
334404
Datum: Decision of the Swedish Authority for Privacy
2025-03-25
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB
(556737-0431) has processed personal data in breach of Article 15 and Article 12(3) of
the General Data Protection Regulation (GDPR)1 by not providing the complainant with
access to his personal data and other supplementary information without undue delay
following a request made by the complainant.
IMY issues a reprimand to Klarna Bank AB pursuant to Article 58(2)(b) of the GDPR
for the infringement found.
Presentation of the supervisory case
IMY has initiated supervision regarding Klarna Bank AB (Klarna or the company) due
to a complaint regarding the right to access. The complaint has been submitted to IMY,
as lead supervisory authority pursuant to Article 56 of the GDPR. The handover has
been made from the supervisory authority of the country where the complaint has been
lodged (Germany) in accordance with the provisions of the GDPR on cooperation in
cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authorities have been the data protection authorities in Austria, Denmark, Finland,
France, Germany, Italy and Norway.
Postadress:
The complainant states, in essence, as follows. The complainant has requested
Box 8114 access to his personal data from Klarna on 19 January 2022 but has not received a
104 20 Stockholm reply to his request.
Webbplats:
www.imy.se
E-post:
[email protected] 1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
Telefon: protection of natural persons with regard to the processing of personal data and on the free movement of such data,
08-657 61 00 and repealing Directive 95/46/EC (General Data Protection Regulation).
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-10270 2(5)
Datum: 2025-03-25
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
decision.
Klarna has essentially stated the following. Klarna is the data controller for the
processing that is the subject of the complaint. The company has received a report of
fraud from the complainant in which a request for access was also expressed. It has
not been possible to verify the date of receipt of the notification, but an internal case
has been created on 15 April 2022. Klarna’s customer service, which specialises in
fraud, has handled the notification in accordance with the fraud case procedure and
notified the complainant on 5 September 2022. On the basis of the documentation, it
appears that the customer service employee did not understand the complainant’s
request for access, but only handled the fraud case. Perceiving requests under the
General Data Protection Regulation is something that all customer service employees
have been trained in, that it does not seem to have been done in this case has been
due to an individual mistake by the customer service employee. Klarna has contacted
the complainant on 21 November 2024 and announced that it intends to comply with
the request. Klarna has asked for a telephone number in order to be able to send a
verification code to open the register extract and intends to send the extract as soon
as the complainant has submitted it.
IMY submitted Klarna’s statement to the supervisory authority in Germany in order to
give the complainant the opportunity to comment on it, but no reply was received by
IMY.
Reasons for the decision
Controller
According to Article 4(7) of the GDPR, ‘controller’ means a natural or legal person,
public authority, agency or other body which, alone or jointly with others, determines
the purposes and meansof the processing of personal data.
Klarna has stated that the company is the controller for the personal data processing
to which the complaint relates, which is supported by the investigation in the case. IMY
therefore considers that Klarna in question is the data controller for the processing
covered by the supervision.
Klarna’s handling of the complainant’s request for access
It follows from Article 15 of the GDPR that the controller is obliged to inform any
person who so requests whether or not personal data relating to the applicant are
being processed. If such data are processed, the controller shall, in accordance with
Article 15 of the GDPR, provide the data subject with additional information
concerning, inter alia, the purposes of the processing and the recipients of the data, as
well as a copy of the personal data processed by the controller. It follows from Article
15(1) and (2) what additional information is to be provided to the data subject. Article
15(3) requires the controller to provide the data subject with a copy of the personal
data undergoing processing.
Pursuant to Article 12(3) of the GDPR, upon request, the controller shall provide the
data subject, without undue delay and in any event no later than one month after
receiving the request, with information on the measures taken pursuant to Article 15 of
the GDPR. That period may be extended, if necessary, by a further two months, taking
into account the complexity of the request and the number of requests received. The
controller shall notify the data subject of such an extension within one month of receipt
of the request, stating the reasons for the delay.
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-10270 3(5)
Datum: 2025-03-25
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
decision.
The investigation into the case shows the following. Klarna has received the
complainant’s request for access. According to Klarna, it has not been possible to
verify exactly when it received the complainant’s request, but that a case related to the
letter of 15 April 2022 has been created. On 26 November 2024, Klarna announced
that it intended to comply with the request and that Klarna had contacted the applicant
in that regard. Klarna also stated to IMY that the reason why the applicant’s request
had not been satisfied in the past was that an individual customer service employee
had not taken note of the applicant’s request for access.
IMY considers that, on the basis of the documentation, it may in any case be
considered clear that Klarna received the complainant’s request for access on 15 April
2022. After IMY commenced supervision of the company, Klarna contacted the
applicant regarding its request for access. By that time, more than two and a half years
had passed since Klarna had received the applicant’s request. There is no indication
that Klarna would have dealt with the complainant’s request if IMY had not initiated
supervision of the case. In the light of the above, IMY considers that Klarna acted in
breach of Article 15 and Article 12(3) of the GDPRby not providing the complainant
with access to his or her personal data and other supplementary information without
undue delay.
Choice of corrective measure
Pursuant to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances of the case need to be taken into consideration. These could include
the nature, gravity and duration of the infringement as well as past infringements of
relevance.
With regard to the choice of intervention, IMY takes account of the following factors.
Klarna has infringed Article 15 and 12(3) of the GDPR. The time which has elapsed
since the request for access was made is relatively long. the infringement concerned a
data subject; Klarna has pointed out that there has been a mistake in the individual
case and that all customer service employees receive training in paying attention to
requests under the General Data Protection Regulation. Klarna has now also
contacted the applicant and that it intends to comply with the applicant’s request. On
an overall assessment, IMY considers that it is a minor infringement as referred to in
recital 148 of the GDPR and that Klarna should therefore be given a reprimand for the
infringement found.
__________________________
This decision has been taken by Head of Unit Nidia Nordenström after presentation by
legal advisor .
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-10270 4(5)
Datum: 2025-03-25
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
decision.
Appendix
The complainant’s personal data
Integritetsskyddsmyndigheten Diarienummer: IMY-2022-10270 5(5)
Datum: 2025-03-25
Notice: This document is an unofficial translation
of the Swedish Authority for Privacy Protection’s
decision.
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.