Notice: This document is an unofficial translation of IMY:s final decision. Only the Swedish
version is authentic.
1(4)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref:
IMY-2024-9637 Decision under the General Data
Date: Protection Regulation
2025-10-20
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB
(556737 – 0431) has now taken measures to comply with the complainant’s requests
for access and deletion. In the light of the above, IMY finds no reason to take any
further action in the case.
The case is hereby closed.
Presentation of the supervisory case
The complainant has lodged a complaint under Article 77 of the General Data
Protection Regulation (GDPR)1 with the Netherlands authority for Personal Data
against Klarna Bank AB (hereinafter Klarna, the company). In accordance with Article
56 of the GDPR, the Netherlands authority for Personal Data has forwarded the
complaint to IMY as the lead supervisory authority.
IMY has initiated supervision of Klarna in order to investigate whether the company
has complied with the complainants’s request for erasure of 23 October 2020 pursuant
to Article 17, and the request for access of 5 November 2020 pursuant to Article
15(1)(g).
The case has been handled through written procedure. IMY has used the mechanism
for cooperation and consistency under Chapter VII of the GDPR.
The complainant has essentially stated that she never purchased anything through
Klarna, that a representative from Klarna once informed how the complainants’s
personal data might have ended up with them, then requested further information, after
Postal address: which it remained silent. In support of the complaint, the complainant has submitted
Box 8114 copies of her requests for erasure and access, and replies from Klarna. It states that
104 20 Stockholm the complainant asked how Klarna obtained her information.
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
08-657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Privacy Protection Authority Act number: IMY-2024-9637 2(4)
Date: 2025-10-20
Klarna has essentially stated the following. The company received the complainant’s
request for erasure of 23 October 2020. Klarna considers the request to have been
processed. On 11 November 2022, on the grounds that the complainant stated not to
have made the purchases, Klarna asked the complainant to confirm that she wanted
the company to carry out the erasure, even though the company would then be unable
to access the information necessary to handle a possible fraud case if the complainant
wishes to request a refund. The complainant did not reply to this. As no confirmation
was received, the erasure has not been carried out. Klarna also received the
complainant’s request for access of 5 November 2020 and responded to the
complainants’s questions on 5 September 2024. In connection with the requests,
Klarna initially requested certain additional information from the complainant to handle
the requests. The individual customer service employee did not inform the complainant
that there were alternative amounts of data to confirm ones identity. This has been
addressed with Klarna’s customer service to prevent this from happening again. After
further investigation in the individual case, the company decided that no further
information was needed, provided that the complainant confirmed the request.
IMY has, through the Netherlands authority for Personal Data, given the complainant
the opportunity to comment on Klarnas’s statement above, but the complainants has
not responded.
Motivation for the decision
In accordance with Article 15(1)(g) of the GDPR, the data subject has the right to
obtain information about the source of their personal data.
In accordance with Article 17 of the GDPR, the data subject has the right, under
certain conditions, to have their personal data erased.
Article 12(2) of the GDPR requires the controller to facilitate the exercise of the data
subject rights under, for example, Articles 15 and 17.
According to Article 12(6) GDPR, in the context of a request under Articles 15 and 17,
the controller may request the provision of additional information necessary to confirm
the identity of the data subject.
Thus, the controller has an obligation both to facilitate the exercise of the data subject
rights and to ensure that additional information is requested only where necessary in
the individual case.
It has emerged that Klarna initially provided incomplete information to the complainant
on what information the company needed to confirm the complainants identity, and
later considered that additional information was not needed if the complainant instead
confirmed the request as described above. It is therefore questionable whether Klarna
has facilitated the exercise of the complainants rights in the present case.
However, IMY finds no reason to question that Klarna has now taken measures to
comply with the complainants request for access under Article 15(1)(g) of the GDPR
and the request for erasure under Article 17.
Privacy Protection Authority Act number: IMY-2024-9637 3(4)
Date: 2025-10-20
In the light of the above, IMY finds no reason to take any further action in the case.
The case should therefore be closed.
Appendix
The complainant’s personal data
Privacy Protection Authority Act number: IMY-2024-9637 4(4)
Date: 2025-10-20
How to appeal
If you wish to appeal the decision, you should write to the Swedish Authority for
Privacy Protection (IMY). Indicate in the letter which decision you wish to appeal and
the change you are requesting. The appeal must have been received by IMY no later
than three weeks from the day you received the decision. If the appeal has been
received in time, IMY will then forward it to the Administrative Court in Stockholm for
review.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. IMY’s contact information is
shown in the first page of the decision.