Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s decision. Only the Swedish version is authentic. 1(12)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref.:
IMY-2025-15400 Final decision under the General Data
German ref: Protection Regulation – Klarna Bank
LDA-1085.1-6749/20-F
IMI case register:
AB
134858
Date:
2025-11-27
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB
(556737-0431) has processed the complainants’ personal data in breach of Article 6 of
the General Data Protection Regulation (GDPR)1 by not having a legal basis for the
processing.
IMY issues a reprimand to Klarna pursuant to Article 58(2)(b) of the GDPR for the
infringement found.
Presentation of the supervisory case
Facts and handling of the case
IMY has initiated supervision against Klarna Bank AB (Klarna or the company) in case
IMY-2022-2507 following several complaints against the company, including the
complaint in the present case. In the complaints, the complainants allege shortcomings
in Klarna’s processing of personal data linked to the fact that the company provides a
function that entails the automatic filling in of the complainants’ personal data. Klarna
refers to the current function of automatic filling of data2. IMY has subsequently
decided to continue processing the present complaint in a separate case with a new
registration number, IMY-2025-15400. This has led to earlier communication in the
present case by letters with registration number IMY-2022-2507. In those letters, the
complaint at issue is referred to as complaint 1.
The handover has been made from the supervisory authority of the country where the
Postal address:
complaint has been lodged (Germany) in accordance with the provisions of the GDPR
Box 8114
104 20 Stockholm
on cooperation in cross-border processing.
Sweden
Website:
www.imy.se
1 Regulation (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the
E-mail:
[email protected] protection of natural persons with regard to the processing of personal data and on the free movement of such data,
and repealing Directive 95/46/EC (General Data Protection Regulation).
Telephone: 2 In this decision, the function is also referred to as automatic filling of personal data, automatic filling of information
+46 (8) 657 61 00 and similar variants. In all these references, it refers to the same function.
Page 1 of 12
Swedish Authority Our ref.: IMY-2025-15400 2(12)
for Privacy Protection Date: 2025-11-27
The case has been handled through written procedure. In light of the complaint relating
to cross-border processing, IMY has used the mechanisms for cooperation and
consistency contained in Chapter VII of the GDPR. The concerned supervisory
authorities have been the data protection authorities in Austria, Germany, the
Netherlands, Norway, Belgium, Denmark, Poland, France, Finland, Italy, Spain and
Hungary.
What the complainant have stated
The complainant stated, in essence, the following. The complainant expresses
dissatisfaction with the fact that his personal data are automatically filled in on orders
when he enters his e-mail address and postal code. This is done without the
complainant being logged in or registered. Klarna has no legal basis for this
processing. The complainant has also requested that all of its personal data be erased
from Klarna, which it is not obliged to keep for legal reasons. Klarna did not comply
with the complainant’s request.
What Klarna has stated
Controller of the personal data
Klarna has stated to IMY on 16 June 2022 that Klarna is the controller of the
processing to which the complaint relates. In its statement of 17 March 2025, Klarna
stated that, as of 14 February 2025, it is no longer the controller of personal data for
the automatic filling in of information.
Request for erasure
In essence, Klarna has stated the following in regard to the complaint relating to the
complainant’s request for erasure.
Klarna received the complainant’s request for erasure on 28 January 2020. The
complainant’s request was received by post and the complainant did not provide an
email address. On 13 February 2020, Klarna sent a letter to the complainant
requesting further information on the email and invoice number to Klarna through
which Klarna can identify/verify the complainant. The complainant never responded to
Klarna’s request for additional information/verification, which resulted in Klarna not
being able to identify/verify the complainant. Klarna was therefore also unable to grant
the complainant’s request for erasure. Klarna has not received the complainant’s
additional information dated 2 March 2020. With the new information that Klarna
received from IMY regarding the complainant’s email address, Klarna contacted the
complainant on 7 October 2025 to confirm that the request is still relevant, and if so, to
comply with the request.
Automatic filling of information
Klarna Shopping Service and Klarna Checkout
Automatic filling of information constitutes a function of the Service. It is very important
for Klarna that the purchase and payment process is as simple, smooth and easily
accessible as possible. One way for Klarna to ensure a smooth shopping experience
for their consumers is through the features included in the Service. Automatic filling of
information is one of several features included in the Service and helps to provide a
smoother shopping experience by eliminating the need for customers to fill in their
contact and delivery information every time they shop with Klarna.
Page 2 of 12
Swedish Authority Our ref.: IMY-2025-15400 3(12)
for Privacy Protection Date: 2025-11-27
Klarna Checkout ("KCO") is Klarna's complete checkout solution and contains all
payment methods from Klarna. When a customer chooses the payment method Klarna
in KCO, the customer is offered to accept the terms and conditions of Klarna's
Shopping Service (the "Agreement") in connection with their purchase. The customer
always has the opportunity to choose to pay directly by card in KCO without accepting
the agreement.
Automatic filling of information
Klarna is used by 150 million consumers globally and automatic filling of information is
an appreciated feature that customers use and expect to get delivered from Klarna.
Access and activation of the function takes place for the first time when the consumer
accepts the agreement in connection with a purchase via the payment method Klarna
in KCO in which the consumer enters their contact details in the address form for the
first tim, or when the consumer logs in for the first time in the Klarna app and in
connection with this accepts the agreement. The consumer can turn off the function at
any time either directly in the address form in KCO or via settings in the Klarna app.
Automatic filling of information makes it easier for the consumer by not having to re-
enter their contact and delivery details with each purchase. The automatic filling of
information is one of the most appreciated functions among Klarna's customers.
Klarna users have the opportunity to control and customize their shopping experience
with Klarna. For example, the customer can choose to make purchases with Klarna
without their information being automatically filled in by Klarna. If the customer makes
his/her purchases in KCO without using the Service and accepting the agreement in
connection with the purchase, e.g. by paying by card in KCO instead of clicking on
Klarna and using any of the payment options provided there, the function is never
activated.
A customer who has accepted the agreement also has the opportunity to customize or
disable functions included in the Service. For example, the customer can choose to
turn off automatic filling of information on their own or with the help of Klarna's
customer service. The customer can also choose to no longer use any of the functions
of the Service by terminating the agreement and then choose to pay directly by card in
KCO, after which the customer's information will no longer be automatically filled in the
address form.
The personal data processed in connection with Klarna delivering the function in the
address form in KCO is name, e-mail address, telephone number, address and either
national identification number or date of birth (depending on the market). The personal
data is saved when the customer accepts the agreement for the first time and fills in
their contact details in the address form in KCO, in which case the function is activated
for the customer's future purchases.
The function can be delivered in two ways. The customer can enter limited contact
information to themselves in the address form (e.g. e-mail address and postal code)
after which Klarna automatically fills in the remaining information. It can also be
delivered by automatic recognition via a cookie that Klarna places on the consumer's
device. Delivery of automatic recognition via this cookie can only take place as long as
the cookie remains on the device.
Page 3 of 12
Swedish Authority Our ref.: IMY-2025-15400 4(12)
for Privacy Protection Date: 2025-11-27
Legal basis
The legal basis for the processing of personal data for the delivery of automated filling
of information is performance of a contract pursuant to Article 6(1)(b) GDPR.
The entering of a service agreement for the Service between the customer and Klarna
means that Klarna has undertaken to deliver a service in accordance with the
description set out in the terms and conditions of the Service. Section 1 of the Terms
and Conditions states that Klarna automatically fills in information in the address form
after the customer has filled in limited information, including the following.
When you use Klarna, we may ask for information such as name, address,
telephone number, e-mail address, date of birth and/or social security number,
as well as other information if applicable. We will store this information in our
systems, and when you return to us or use the Service or our payment services,
you only need to provide some of this information, such as your e-mail address
and postal code or social security number (depending on the country), in order
for us to fill in the remaining fields with your other information.
The function only fills in information provided by the consumer themself. Klarna does
not display additional personal data beyond those already provided by the consumer
and requested to be filled in automatically. In addition, the customer already has the
possibility to turn off the function when approving the agreement. No personal data is
automatically filled in by Klarna in cases where the customer has turned off the
function, never activated it, not accepted the agreement or terminated the agreement
at a later stage.
The contract is made available when making a purchase with Klarna in KCO, on
Klarna's website and via a link to Autofill settings in the address form. In addition, by
clicking on the link to the settings, the customer can easily customize the auto-fill
function, for example, choose to disable the function completely.
Klarna has assessed that the processing of personal data that takes place in order to
provide the function is necessary for Klarna to be able to fulfil the contract with the
consumer.
The specific purpose of the processing of personal data for the automatic filling of
information function is to enable consumers to save time when buying online by
entrusting Klarna with filling in the consumer's personal data in the address form in
KCO.
Klarna provides the Service (including the automatic filling of information) only to
consumers who have accepted the terms and conditions of the Service. In order to
avoid that the consumer is faced with an ‘all or nothing’ situation, Klarna has made it
possible for the consumer to customize Klarna’s Shopping Service to his or her needs.
The consumer can therefore disable the function for automatic filling of information.
This choice can either be made when the consumer first accepts the terms of the
Service, or at a later time. If the consumer deactivates the function, Klarna will not
process the consumer's personal data for this purpose.
Since the consumer can customize the functions of the Service to his or her liking, e.g.
by disabling the automatic filling of information function, Klarna has considered the
function as a stand-alone service within the scope of the Service.
Page 4 of 12
Swedish Authority Our ref.: IMY-2025-15400 5(12)
for Privacy Protection Date: 2025-11-27
In its ongoing data protection work, Klarna has taken into account the European Data
Protection Board (EDPB) Guidelines 2/2019 when selecting contracts as the
appropriate legal basis for the processing of personal data for the automatic filling of
information function. It follows, inter alia, from those guidelines that, where a contract
consists of several distinct services or parts of a service that can reasonably be
performed independently of each other, the application of Article 6(1)(b) of the GDPR
must be assessed in the light of each of those functions/services separately. This
assessment must then be made by examining what is objectively necessary to perform
the individual function/service requested by the consumer.3
In the light of these guidelines, Klarna has assessed the applicability of Article 6(1)(b)
GDPR to the automatic filling function separately. Klarna has thus considered that the
processing of personal data carried out in order to provide the function of automatic
filling of information is objectively necessary in order for that function to be offered to
consumers. The function is not possible to provide without processing the personal
data. Thus, the processing of personal data is a particularly integral part of the
automatic filling of information function and the provision of that function is in the
interest of both parties, since otherwise that function would have been impossible to
provide and the contract could not have been performed.
In assessing the most appropriate legal basis for the data processing, Klarna has also
considered the impact of the legal basis on the rights of consumers as data subjects
and their reasonable expectations. Klarna's view is that the chosen legal basis gives
the consumer great control over the processing of their personal data. This is because
the processing takes place exclusively at the consumer's own request and because
Klarna provides easily accessible mechanisms that guarantee that the consumer can
deactivate the function at any time and thus no longer be subject to personal data
processing for automatic filling of information. In Klarna's opinion, it strengthens the
legitimacy of Klarna's processing of personal data for the function automatic filling of
information. Klarna's view is also that the processing meets the average customer's
reasonable expectations.
This is because Klarna provides the consumer with easily accessible and clear
information both in connection with the acceptance of the terms and conditions of the
Service, as well as at every time the consumer purchases online and automatic filling
of information takes place in the address form in KCO.
Klarna is of the opinion that a number of legal bases in Article 6(1) of the GDPR could
be possible legal bases for the processing of personal data for the function of
automatic filling of information. However, Klarna’s assessment is, and has always
been, that the most appropriate legal basis is Article 6(1)(b) GDPR.
The Complainant is an active user of the Service. This means that the complainant has
accepted the agreement and has not turned off the automatic filling of information or
terminated the agreement with Klarna.
3 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 37, translation, original: ‘Where the contract consists of
several separate services or elements of a service that can in fact reasonably be performed independently of one
another, the question raised to which extent Article 6(1)(b) can serve as a legal basis. The applicability of Article
6(1)(b) should be assessed in the context of each of those services separately, looking at what is objectively
necessary to perform each of the individual services which the data subject has requested or signed up for.’
Page 5 of 12
Swedish Authority Our ref.: IMY-2025-15400 6(12)
for Privacy Protection Date: 2025-11-27
Justification of the decision
Investigation of the complaint
It follows from Article 57 (1)(f) that IMY shall process complaint about incorrect
processing of personal data and, where appropriate, investigate the subject matter of
the complaint.
In his complaint, the complainant stated that he had made a request for erasure but
that Klarna had not complied with that request.
In the context of the handling of the complaint at issue, IMY questioned Klarna
concerning the complaint’s request for erasure.
Klarna has, among other things, stated the following to IMY. Klarna has received the
complaint’s request for erasure. The request was received by post and the
complainant did not provide an e-mail address. Klarna needed the complainant’s email
address to verify/identify the complainant. The complainant was given the opportunity
to comment on Klarna’s reply to IMY in this regard. No reply has been received by
IMY. Against that background, IMY considers that there is no reason to question the
statements made by Klarna in this regard.
Klarna has also stated the following to IMY. Klarna has not received the
supplementary information annexed by the complainant dated 2 March 2020. After
IMY sent the additional information attached by the complainant to the complaint,
Klarna contacted the complainant to confirm whether the request is still up-to-date and,
in such a case, to comply with the request.
In the light of the foregoing, IMY considers that there is no reason for taking further
investigative measures in the part of the complaint relating to the complainant’s
request for erasure. IMY instead proceeds with the investigation of the part of the
complaint concerning whether Klarna processed the complainant’s personal data in
breach of Article 6 of the GDPR.
Assessment of Klarna's legal basis for automatic filling in of
information
In addition, the complainant claims that his personal data are automatically filled in in
the case of orders when he has provided his email address and postal code and that
Klarna has no legal basis for that processing. Klarna has stated that the company uses
the legal basis contract in Article 6(1)(b) of the GDPR to automatically fill in users'
personal data when they make purchases with Klarna in KCO.
Applicable provisions
It follows from Article 6(1)(b) of the GDPR that processing is lawful only if and to the
extent that processing is necessary for the performance of a contract to which the data
subject is party, or for taking steps at the request of the data subject prior to the
conclusion of such a contract.
‘Necessary’ is an autonomous concept of EU law. According to the European Court of
Justice (CJEU), the notion of ‘necessity’ must be interpreted and applied in such a way
Page 6 of 12
Swedish Authority Our ref.: IMY-2025-15400 7(12)
for Privacy Protection Date: 2025-11-27
that it fulfils the purpose of data protection legislation.4 In that regard, the CJEU has
held, in particular, that exceptions and limitations to the protection of personal data
must be limited to what is strictly necessary.5 The CJEU has also held that, in order for
the controller to be able to support processing on the basis of Article 6(1)(b) of the
GDPR, the processing must be objectively indispensable in order to achieve a purpose
which constitutes an essential element of the service intended for the data subject.
The controller must be able to demonstrate how the main purpose of the contract
could not be achieved without the processing in question. Processing must be strictly
necessary in order to be able to rely on Article 6(1)(b) and it is irrelevant in that regard
that processing is useful for the performance of a contract.6 The notion of ‘necessary’
must therefore be interpreted restrictively when assessing whether contract can be
used as a legal basis for the processing of personal data.
The Article 29 Working Party, now known as the European Data Protection Board
(EDPB), also advocates for a restrictive interpretation of the term ‘necessary’ in its
guidance. The notion shall not cover situations in which the processing of personal
data of the data subject is carried out as a result of a unilateral decision of the
controller, only such processing as is strictly necessary for the performance of a
contract.7 The EDPB further emphasizes that there is a clear link between the question
of whether processing is necessary and the question of whether processing complies
with the principle of purpose limitation in Article 5(1)(b) of GDPR. It is therefore
important to determine the precise purpose of the agreement, i.e. the subject-matter of
the agreement and its underlying purpose. This is because they shall form the basis
for the assessment of whether the processing of the personal data is necessary for the
performance of a contract.8 The ‘necessary for the performance’ of a contract is a
higher requirement than the mere existence of a contractual clause.9 Processing that is
useful but objectively not necessary for the performance of a service cannot be
regarded as falling within the scope of Article 6(1)(b) of the GDPR, even if it is
necessary for the purposes of the other activities of the controller.10
Data controllers shall also consider the principle of proportionality and consider
alternative and less far-reaching interferences with the protection of the privacy of data
subjects.11 If there are realistic and less intrusive options, the processing is not
necessary.
The controller must also be able to justify the need for processing by referring to the
basic and mutually understood purpose of the contract. That purpose must be
understood not only from the perspective of the controller, but also from the
perspective of a reasonable data subject when entering the contract, and whether the
contract can nevertheless be regarded as ‘fulfilled’ without the processing in question.
Even if the controller considers that the processing is necessary for the purpose of the
contract, it is important that the controller carefully examines the perspective of an
4 Case C‐524/06, Heinz Huber v Germany, EU:C:2008:724, 18 December 2008, p. 52.
5 Case C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v Rīgas pašvaldības SIA ‘Rīgas
satiksme’, EU:C:2017:336, 4 May 2017, p. 30.
6 Case C-252/21, Meta Platforms v Bundeskartellamt, EU:C:2023:537, 4 July 2023, p. 98 and 99.
7 WP29 Opinion 06/2014 on the notion of legitimate interest, 844/14/EN WP217, p. 16.
8 WP29 Opinion 06/2014 on the notion of legitimate interest, 844/14/EN WP217, p. 17.
9 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 27.
10 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 25.
11 Joined Cases C‐92/09 and C‐93/09 Volker und Markus Schecke GbR (C‐92/09), Hartmut Eifert (C‐93/09) v Land
Hessen EU:C:2010:662, 9 November 2010, p. 86.
Page 7 of 12
Swedish Authority Our ref.: IMY-2025-15400 8(12)
for Privacy Protection Date: 2025-11-27
average data subject to ensure that there is a genuine mutual understanding of the
purpose of the contract.12
The EDPB has developed a number of conditions in its Guidelines that are intended to,
inter alia, assist controllers in determining whether Article 6(1)(b) GDPR applies to a
particular processing activity.13
IMY:s assessment whether automatic filling of information is a stand-alone
service
KCO is a web interface in which an active or prospective user can pay for goods and
services on the internet through Klarna's payment services, such as invoice or partial
payment.
If a user wants to use any of Klarna's payment services, they are required to enter into
a contract regarding the Service. The purpose of the service is to facilitate and simplify
purchasing processes on the internet through several functions. One of these functions
is the automatic filling of information.
In its statement of 31 October 2022, Klarna stated, as it must be understood, that the
automatic filling of information is an independent service in the Service and that the
processing of personal data involving automatic filling is objectively necessary in order
to be able to provide the function.
Paragraph 37 of EDPB Guidelines 2/2019 states that a specific assessment is required
if Article 6(1)(b) GDPR is an applicable legal basis for the processing to provide a
specific service, if that service is part of one of several independent services of a larger
service.14
The documentation in the case shows that Klarna, within the framework of the Service,
processes personal data to support the use of Klarna's payment options. It is not
possible to use any of Klarna's payment options without entering into the contract. It
has not been shown in the case that the function has any independent purpose other
than to facilitate the use of Klarna's payment options, for example that Klarna offers
automatic filling for situations other than the use of Klarna's payment services in KCO.
IMY does not object to the fact that it in principle is possible to offer a service that
generally facilitates and simplifies online purchasing processes. However, in the
present case, the function is closely linked to the use of Klarna’s payment options in
particular.
IMY thus concludes that the function of automatic filling in of personal data is not
independent in such a way that it should be assessed separately from the Service.
IMY:s assessment of Klarna’s legal basis
IMY notes that a user must accept the contractual terms of the Service in order to use
any of the payment services provided by Klarna, e.g. payment against invoice or
12 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 32.
13 EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 33.
14 See IMY’s report of Klarna’s statement of 31 October 2022 above, in which Klarna refers to EDPB Guidelines
2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of providing online services to
data subjects, version 2.0, p. 37. See also case C-252/21 Meta Platforms v Bundeskartellamt, EU:C:2023:537, p. 100.
Page 8 of 12
Swedish Authority Our ref.: IMY-2025-15400 9(12)
for Privacy Protection Date: 2025-11-27
partial payment. When a user accepts the contract, an account is created and a
number of functions in the Service are activated, including automatic filling of
information. This feature can be disabled but is enabled by default.
Klarna's description of the Service in the agreement states the following.
For Klarna, shopping is not only about finding good things and paying for them -
but also about getting a great shopping experience in your favorite store, a
state-of-the-art app and more. Put simply: A smoooth experience, both before
and after a purchase. [...]
The documentation in the case shows that the purpose of the Service is, among other
things, to provide features that give Klarna's users a smooth shopping experience.
Automatic filling of information is intended to make it easier for users to shop online by
automatically filling their contact and delivery information with each subsequent
purchase. Klarna creates an account for a prospective user when they use one of
Klarna's payment services in KCO for the first time and accept the contract for the
Service.15 Klarna has stated that processing for automatic filling takes place when
active users choose to pay with Klarna in KCO.
In this regard, IMY considers that the content and basic purpose of the agreement is to
simplify and support the use of Klarna’s payment services with the functionalities of the
Service. IMY notes that the function in this regard is presented as a condition of the
contract, but it is not in itself sufficient for the processing in question to be considered
necessary for the performance of the contract.16
IMY notes that it is possible for Klarna's users to disable the function for automatic
filling of personal data and then continue to use the Service. Klarna's active users can
thus choose to manually enter their personal data in KCO without automatic filling for
future purchases with Klarna's payment services, without affecting the contractual
relationship. IMY considers that this freedom of choice is a strong indication that
automatic filling constitutes processing which, on the one hand, is useful for Klarna’s
purpose of providing smooth and easily accessible payment processes, but which, on
the other hand, is not objectively necessary for the performance of the contract.17
With regard to the parties' mutual perspectives and expectations, there is the question
if an average user of the Service should reasonably expect that automatic filling of
information will take place in order for Klarna to be able to deliver the Service.
The documentation in the case shows that automatic filling in of data is activated by
default at the conclusion of the contract and that activity from the data subject is
required to disable the function. Klarna has stated in this regard that the feature is
highly appreciated and that many of their customers expect it to be delivered. IMY
notes that the complainants in the supervisory case, on the other hand, perceive the
function as surprising and intrusive. The complainants’ attitude to the processing
indicates that, in any event, these users had not expected or understood that their
15 The terms and conditions for Klarna's Shopping Service state the following: ‘When you use one of our payment
services at a store checkout or when you download and log in to Klarna’s App, we will create a Klarna User Account
for you.’
16 See Case C-252/21, Meta Platforms v Bundeskartellamt, EU:C:2023:537, 4 July 2023, p. 98 and 99. See also
EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 27.
17 Cf. EDPB Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the
provision of online services to data subjects, version 2.0, p. 25.
Page 9 of 12
Swedish Authority Our ref.: IMY-2025-15400 10(12)
for Privacy Protection Date: 2025-11-27
personal data would be used for automatic filling when registering an account with
Klarna.
IMY notes that Klarna markets its payment services as simple, convenient and easily
accessible. IMY does not question that the functions in the Service are also intended
to make Klarna's payment services simple, smooth and easily accessible. IMY
considers, however, that the marketing does not mean that an average user of
Klarna's services should be expected to understand from the marketing that their
personal data will be processed to provide various functions, including for automatic
filling, as the present complaint also shows. A first-time user of Klarna's payment
services may also use the Service without having seen any marketing.
Against that background, IMY takes the view that the complainant should not be
regarded as having had a reasonable expectation that his personal data would be
automatically filled in for future purchases with Klarna in KCO when he entered into the
contract for the Service.
IMY:s overall assessment is that that Klarna's processing of personal data for
automatic filling of information is unexpected in relation to what an average reasonable
user should have expected from the Service. The feature is optional and can be
disabled.18 Hereafter, a user can continue to use the Service and Klarna's payment
services without affecting the contractual relationship.
Against this background, IMY considers that automatic filling in of information is not
objectively necessary for the performance of the contract. Klarna cannot therefore rely
on Article 6(1)(b) of the GDPR for the automatic filling of information.
IMY has asked Klarna if the company has had any other legal basis for the personal
data processing in question. Klarna has stated that contract is the most appropriate
legal basis for the processing in question and has not provided any justification or
arguments regarding alternative legal bases, nor has any other legal basis been
identified.
Under these circumstances, IMY takes the view that Klarna, by providing the automatic
data-filling function, processed the complainant’s personal data in breach of Article 6 of
the GDPR.
Choice of corrective measure
Pursuant to Article 58(2)(i) and Article 83(2) of the GDPR, IMY has the power to
impose administrative fines in accordance with Article 83. Depending on the
circumstances of the case, administrative fines shall be imposed in addition to or
instead of the other measures referred to in Article 58(2), such as injunctions and
prohibitions. Furthermore, Article 83(2) determines the factors to be considered when
imposing administrative fines and when determining the amount of the fine. In the case
of a minor infringement, IMY may, as stated in recital 148, instead of imposing a fine,
issue a reprimand pursuant to Article 58(2)(b). Aggravating and mitigating
circumstances of the case need to be taken into consideration. These could include
the nature, gravity and duration of the infringement as well as past infringements of
relevance.
18 Cf. EDPB analysis in Section 5.4.2.1 of Binding Decision 2/2022 on the dispute that has arisen on the IE SA Draft
Decision on Meta Platforms Ireland Limited (Instagram) pursuant to Article 65(1)(a) GDPR.
Page 10 of 12
Swedish Authority Our ref.: IMY-2025-15400 11(12)
for Privacy Protection Date: 2025-11-27
With regard to the choice of corrective measure, IMY takes into account, inter alia, the
following. The case in question concerns a data subject. In a decision no. 790-2017 of
19 September 2017, IMY made the assessment that Klarna's personal data processing
in KCO was permitted on the legal basis of a contract under Section 10 of the
previously enforced Personal Data Act19 (1998:204) (PUL), inter alia on the grounds
that customers could opt out of automatic filling of information. Klarna can thus be
considered to have had some justification for its erroneous view that contracts can be
used as a legal basis for automatic filling in of information.
In an overall assessment of the circumstances of the present case, IMY considers that
Klarna should be given a reprimand for the infringement found.
This decision has been made by Head of Unit after a
presentation by legal advisor .
Appendix
The complainant’s personal data
Copy to
Data Protection Officer
19 Section 10 of the Personal Data Act states that personal data may only be processed if the data subject has given
consent to the processing or if the processing is necessary for one of the reasons set out in the Act. Examples of such
reasons are if the processing takes place in order for a contract with the data subject to be performed.
Page 11 of 12
Swedish Authority Our ref.: IMY-2025-15400 12(12)
for Privacy Protection Date: 2025-11-27
How to appeal
If you wish to appeal the decision, you should write to IMY. Indicate in your letter the
decision you wish to appeal and the amendment you are requesting. The appeal must
be received by IMY within three weeks of the date on which you received the decision.
However, if you are a party representing the public, the appeal must be received within
three weeks of the date of notification of the decision. If the appeal has been received
in due time, IMY will forward it to the Administrative Court in Stockholm for
consideration.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. The contact details of the
authority can be found on the first page of the decision.
Page 12 of 12