Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision Only the Swedish version is authentic. 1(2)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref.:
IMY-2024-10369 Final decision under the General Data
Nat.ref.no: Protection Regulation – CDON AB
521.17488
IMI case register:
535935
Date:
Decision of the Swedish Authority for Privacy
2025-05-09 Protection
The Swedish Authority for Privacy Protection (IMY) notes that Klarna Bank AB
(556737-0431) has now complied with the applicant´s request for erasure. In the light
of the above, IMY finds no reason to take any further action in this case.
The case is closed.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision against
Klarna Bank AB (Klarna) due to a complaint. The complainant has been submitted to
IMY, as the lead supervisory authority under Article 56 GDPR, by the supervisory
authority of the country (Germany) in which the complainant lodged its complain in
accordance with the Regulation´s provisions on cooperation in cross-border
processing.
Since it is a cross-border complaint, IMY has made use of the mechanisms got
cooperation and consistency of the GDPR. The supervisory authorities concerned
have been the data protection authorities in the Netherlands, Germany, France,
Norway, Luxemburg, Italy, Ireland, Austria, Poland, Denmark and Spain.
The complainant essentially states the following: The complainant requested erasure
in accordance of article 17 GDPR from Klarna. Klarna has not complied with the
request.
Klarna essentially states the following. Klarna can´t find the conversation to which the
complainant refers to in his complaint nor can Klarna verify when the letter from the
Postal address:
Box 8114 complainant was received. Klarna became aware of the complaint in September 2024.
104 20 Stockholm On the 10th of September 2024 Klarna handled the case by initiating the deletion
Sweden process. The complainant was informed on the 16th of September that the erasure
Website: process has been completed.
www.imy.se
E-mail: IMY has sent Klarnas statement to the supervisory authority of the country in which the
[email protected] complainant lodged its complaint to give the complainant opportunity to comment on
Telephone: the statement. The complainant has been informed about the erasure from Klarna but
+46 (8) 657 61 00
Page 1 of 2
Swedish Authority Our ref.: IMY-2024-10369 2(2)
for Privacy Protection Date: 2025-05-09
as stated that he is not in position to check whether the account has actually been
deleted. As when he tries to log in, no message is displayed that the account does not
exist, but the Klarna system appears to be trying to re-register the account. The
deletion request was submitted on the 29th of may 2023. Klarna has taken more than a
year to delete this data.
Motivation for the decision
The complainant has requested erasure of his personal data. According to Article
17(1) GDPR, the data subject shall have the right to obtain from the controller the
erasure of his or her personal data without undue delay and the controller shall be
obliged to erase personal data without undue delay, under certain conditions set out in
the relevant article.
Klarna Bank AB has informed IMY that Klarna Bank AB has now deleted the
complainant’s personal data. IMY finds no reason to question that this has happened.
IMY notes that Klarna Bank AB has therefore now complied with the complainant’s
right to erasure. Against this background, IMY does not find any further action to be
taken in this case.
The case should therefore be closed.
This draft decision has been approved by head of unit after
presentation by legal advisor
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.
Page 2 of 2