Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(2)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref.:
IMY-2025-2280 Final decision pursuant to Article 60
Dutch ref: under the General Data Protection
2024-001206
IMI case register:
725159
Regulation – Klarna Bank AB
Date:
2025-05-13
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection finds that Klarna Bank AB, 556737-0431,
has complied with the complainant’s request for access. In the light of the above, IMY
finds no reason to take any further action in this case.
The case should therefore be closed.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision regarding
Klarna Bank AB (Klarna) due to a complaint. The complaint has been submitted to
IMY, as lead supervisory authority pursuant to Article 56 of the GDPR. The handover
has been made from the supervisory authority of the country where the complaint has
been lodged (the Netherlands) in accordance with the provisions of the GDPR on
cooperation in cross-border processing.
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR.
The complainant has primarily stated the following. On October, 23 2023 the
complainant requested access to his personal data and, in particular, requested
information on the personal data on which the decision to block his account was
based, the external sources used and other relevant information. According to the
complainant, he has not received a satisfactory response to his request.
Postal address:
Box 8114
104 20 Stockholm
Klarna has primarily stated the following. Klarna is the controller concerning the
Sweden processing to which the complaint relates. Klarna cannot find any request for access
Website:
from the complainant as of October, 23 2023. However, Klarna received a request for
www.imy.se access from the complainant on January, 23 2024 and replied to it on the same day.
E-mail:
The complainant wanted to identify himself through a third-party identification service
[email protected] that Klarna does not support and stated that he wanted to get in touch with the privacy
Telephone: department instead of customer service. As there was confusion about the
+46 (8) 657 61 00 complainant’s identification due to his request to use only the initials in his name, the
Page 1 of 2
Swedish Authority Our ref.: IMY-2025-2280 2(2)
for Privacy Protection Date: 2025-05-13
customer service agent referred the complainant to Klarna’s online form to request a
registry extract and to ensures that the person is reliably identified. After receiving the
complaint from IMY, Klarna contacted the complainant on February, 13 2025, asking
him to confirm the validity of the access request and requesting additional personal
data in order to proceed with the identification. On the same day, the complainant
confirmed that he wishes to obtain an extract from the register and provided the
requested information for identification. The applicant’s request for access was granted
on February, 21 2025. The register extract contained information on which external
sources that was used to verify the complainant’s personal data and Klarna has thus
fulfilled its obligations under Article 15(1)(g) of the GDPR.
The complainant has been given the opportunity to comment on the company’s
statement and has responded that the complaint is resolved.
Motivation for the decision
The complainant has requested access to his personal data pursuant to Article 15 of
the GDPR. The right of access follows from Article 15 of the GDPR. According to
Article 15(1) a data subject has the right to obtain confirmation as to whether or not
personal data concerning him or her are being processed and, if so, access to the
personal data and to information on, inter alia, the source of data that is not collected
from the data subject.
Klarna has informed IMY that the company has now granted the appellant access to
his personal data and the information referred to in Article 15. IMY finds no reason to
question that this has been done and the complainant has also stated that the
complaint has now been resolved. IMY therefore notes that Klarna has now complied
with the complainant’s right of access. In the light of the above, IMY finds no reason to
take any further action in the case.
The case should therefore be closed.
This decision has been made by the specially appointed decision maker
.
Appendix
The complainant’s personal data
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.
Page 2 of 2