Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(4)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref.:
IMY-2025-12085 Final decision under the General Data
Case number at the German Protection Regulation – Klarna Bank
Supervisory Authority
[222-21-109/2024 AB
IMI case register:
796815
Date:
2025-10-13
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB
(556737-0431) has processed personal data in violation of Article 12.3 of the General
Data Protection Regulation1 by failing to provide the complainant, without undue delay,
with access to their personal data and other supplementary information in accordance
with Article 15 of the General Data Protection Regulation.
The Swedish Authority for Privacy Protection issues a reprimand against Klarna Bank
AB pursuant to Article 58.2(b) of the General Data Protection Regulation for the above
infringement.
Presentation of the supervisory case
The Swedish Authority for Privacy Protection (IMY) has initiated supervision of Klarna
Bank AB (Klarna or the bank) with the purpose of investigating a complaint concerning
the right of access. The complaint has been referred by the supervisory authority in the
country where the complainant lodged their complaint (Germany), in accordance with
the Regulation’s provisions on cooperation in cases of cross-border processing. IMY
has handled the complaint in its capacity as the lead supervisory authority pursuant to
Article 56 of the General Data Protection Regulation.
The procedure has been conducted through written correspondence. Due to the cross-
border nature of the supervisory case, IMY has made use of the cooperation
mechanisms and consistency mechanisms set out in Chapter VII of the General Data
Postal address:
Protection Regulation. The concerned supervisory authority has been the data
Box 8114
104 20 Stockholm
protection authority in Germany.
Sweden
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
+46 (8) 657 61 00 Directive 95/46/EC (General Data Protection Regulation)
Page 1 of 4
Swedish Authority Our ref.: IMY-2025-12085 2(4)
for Privacy Protection Date: 2025-10-13
The complainant has essentially put forward the following. On 10 May 2024, he
exercised his right of access under the General Data Protection Regulation against
Klarna. As of 20 August 2025, his request had still not been fulfilled.
Klarna has essentially put forward the following. Klarna is the data controller for the
processing to which the complaint relates. Klarna considers that the complainant’s
request was received on 14 June 2024, when a case was registered via Klarna’s
complaints form. On 17 June 2024, Klarna responded to the complainant in the
relevant case. However, the response focused on a billing dispute and not on the
complainant’s request for access under Article 15 of the General Data Protection
Regulation. It later emerged that the complainant’s request had not been identified as
a formal access request. The complainant’s request was fulfilled on 8 September
2025. Since Klarna did not recognize the complainant’s request as an access request,
the request was not processed, and Klarna also did not inform the complainant of the
reasons for the delay pursuant to Article 12.3 of the General Data Protection
Regulation.
IMY’s assessment
Klarna’s handling of the complainant’s access request
From Article 15(1) of the General Data Protection Regulation it follows that the data
subject shall have the right to obtain from the controller confirmation as to whether or
not personal data concerning him or her are being processed, and, where that is the
case, access to the personal data. From Article 15(1) and (2) of the Regulation it
further follows that the data subject has the right to receive certain supplementary
information regarding the processing of personal data. Pursuant to Article 15(3) of the
same Regulation, the controller shall provide the data subject with a copy of the
personal data undergoing processing.
Article 12(3) of the General Data Protection Regulation provides that, upon request of
the data subject, the controller shall, without undue delay and in any event within one
month of receipt of the request, provide the data subject with information on the
measures taken under Article 15. That period may, where necessary, be extended by
a further two months, considering the complexity and number of the requests.
At the outset, IMY notes that the parties have put forward two different dates for when
the complainant’s access request was received by Klarna. The complainant claims that
his access request was received by Klarna on 10 May 2024. Klarna, on the other
hand, argues that the request was only received by the bank on 14 June 2024. The
complainant has attached to his complaint email correspondence between himself and
the bank.
IMY considers, particularly in light of the copies of the emails submitted by the
complainant, that the investigation in the case demonstrates that Klarna received an
access request from the complainant on 10 May 2024.
It is further undisputed that the complainant’s access request was not initially fulfilled.
Klarna has stated that the bank fulfilled the complainant’s access request on 8
September 2025. IMY finds no reason to question this information and therefore notes
that the complainant’s request has now been fulfilled. At that point, however, more
than a year had passed since the complainant submitted his access request.
Page 2 of 4
Swedish Authority Our ref.: IMY-2025-12085 3(4)
for Privacy Protection Date: 2025-10-13
Against this background, IMY assesses that Klarna acted in violation of Article 12(3) of
the General Data Protection Regulation by failing, without undue delay, to provide the
complainant with access to his personal data and other supplementary information.
Choice of corrective measure
IMY has the possibility to impose a number of measures. From Article 58(2) and Article
83(2) of the General Data Protection Regulation it follows that IMY, among other
things, has the power to impose administrative fines in accordance with Article 83 of
the Regulation. Where the infringement is of a minor nature, IMY may, as stated in
Recital 148 of the General Data Protection Regulation, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances must be considered in each case, such as the nature, gravity and
duration of the infringement, as well as any previous relevant infringements.
With regard to the choice of corrective measure, IMY considers the following
circumstances. Klarna has infringed Article 12(3) of the General Data Protection
Regulation. The infringement concerned a single data subject. Furthermore, Klarna
has since complied with the complainant’s access request.
On the basis of an overall assessment of the circumstances in the present case, IMY
considers that the bank should be issued a reprimand for the established infringement.
This decision was made by Head of Unit after presentation by
legal advisor .
Appendix
The complainant’s personal data
Copy to
Data Protection Officer
Page 3 of 4
Swedish Authority Our ref.: IMY-2025-12085 4(4)
for Privacy Protection Date: 2025-10-13
How to appeal
If you wish to appeal the decision, you should write to IMY. Indicate in your letter the
decision you wish to appeal and the amendment you are requesting. The appeal must
be received by IMY within three weeks of the date on which you received the decision.
However, if you are a party representing the public, the appeal must be received within
three weeks of the date of notification of the decision. If the appeal has been received
in due time, IMY will forward it to the Administrative Court in Stockholm for
consideration.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. The contact details of the
authority can be found on the first page of the decision.
Page 4 of 4