Notice: This document is an unofficial translation of the Swedish Authority for
Privacy Protection’s draft decision. Only the Swedish version is authentic. 1(6)
COMPLAINANT
See appendix
CONTROLLER
Klarna Bank AB
Swedish ref.:
IMY-2025-9248 Final decision under the General Data
German ref: Protection Regulation – Klarna Bank
E-806-4385-287
IMI case register:
AB
CR134712
Date:
2025-12-03
Decision of the Swedish Authority for Privacy
Protection
The Swedish Authority for Privacy Protection (IMY) finds that Klarna Bank AB
(556737-0431) in its handling of the complainant’s request for deletion made on 25
January 2020 has processed personal data in violation of
• Article 12(6) GDPR1 by requesting more information than is necessary to identify
the complainant
• Article 12(2) GDPR by failing to facilitate the exercise of the applicant’s right
• Article 12(3) GDPR by failing to deal with the complainant’s request without delay.
The Swedish Data Protection Authority grants Klarna Bank AB a reprimand under
Article 58(2)(b) of the GDPR for the infringements.
IMY issues a reprimand to Klarna Bank AB pursuant to Article 58(2)(b) of the GDPR
for the infringement of the GDPR.
Postal address:
Box 8114
104 20 Stockholm
Sweden
Website:
www.imy.se
E-mail:
[email protected] 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
Telephone: natural persons with regard to the processing of personal data and on the free movement of such data, and repealing
+46 (8) 657 61 00 Directive 95/46/EC (General Data Protection Regulation).
Swedish Authority Our ref.: IMY-2025-9248 2(6)
for Privacy Protection Date: 2025-12-03
Presentation of the supervisory case
Background and delimitation
IMY has initiated supervision in case IMY-2022-7128 to investigate 28 complaints2
against Klarna Bank AB (Klarna). IMY has subsequently decided that the further
investigation of each complaint will take place in separate cases.
IMY’s investigation of the complaint in the case at hand has been limited to the
questions whether Klarna has acted in accordance with Article 12(6) GDPR when
Klarna requested data to identify the complainant, whether Klarna has facilitated the
complainant’s exercise of its right of access in accordance with Article 12(2) GDPR
and whether the complainant’s request has been handled without undue delay under
Article 12(3) GDPR. The examination of the case concerns Klarna’s handling of the
applicant’s request for deletion made on 25 January 2020. IMY will therefore not take a
position on whether Klarna's current, general procedures for handling requests comply
with the General Data Protection Regulation.
The complaint in the case has been submitted to IMY, as lead supervisory authority
under Article 56 GDPR. The transfer has taken place from the supervisory authority of
the country where the complainant has lodged his complaint (Germany) in accordance
with the provisions of the Regulation on cooperation in cross-border processing.
The proceedings at IMY were conducted by exchange of letters. IMY has made use of
the cooperation and consistency mechanisms provided for in Chapter VII of the GDPR.
The supervisory authorities concerned have been the data protection authorities of
Austria, Hungary, Denmark, Germany, Norway, Finland, Italy, the Netherlands,
Poland, Ireland, France, Estonia and Spain.
Statement by the complainant
The complainant states, in essence, the following. On 25 January 2020, the
complainant requested the erasure of his personal data pursuant to Article 17 of the
GDPR. In the context of its request, the complainant provided the following
information.
• Surname(s) and first name(s)
• Date of birth
• E-mail address
• Card number
The complainant states that, on 13 February 2020, Klarna requested, in addition to the
email address, two of the following information in order to satisfy the request:
• Surname(s) and first name(s)
• Date of birth
• E-mail address used for purchases with Klarna
• Invoice number
• Name of a shop purchased by the complainant
2 IMY initiated oversight following 29 complaints, but on 23 September 2023, the complainant withdrew complaint 14
(DI-2021-5908).
Swedish Authority Our ref.: IMY-2025-9248 3(6)
for Privacy Protection Date: 2025-12-03
• Purchase price
On the same day, the complainant points out that Klarna already has sufficient
information and has resubmitted it. Nevertheless, the complainant has continued to
receive newsletters from Klarna.
Statement by Klarna Bank AB
In summary, Klarna has stated the following about the issues covered by the
supervision.
Klarna received the complainant’s request for deletion on 25 January 2020. Klarna has
handled the request for deletion by starting the identification process on 13 February
2020. The customer service officer who dealt with the case incorrectly assessed the
information submitted by the complainant and therefore requested additional points of
identification despite the fact that the complainant provided sufficient information in its
request of 25 January 2020. On 13 February 2020, the applicant pointed that out and
repeated his name, date of birth and e-mail address. Klarna then commenced the
erasure on 16 March and informed the appellant of this on the same day. Thus, Klarna
did not start the erasure in time, despite the fact that the applicant provided the
personal data required for identification in its request of 25 January 2020. On April 29,
Klarna informed that there is no purchase data linked to the e-mail address and that
there is no data to delete. Thus, the request has been satisfied.
Has Klarna had reason to doubt the identity of the appellant?
At the time of the request, Klarna had no reason to doubt the applicant’s identity.
Klarna has received enough identification points to identify the complainant in the first
email and the customer service agent should therefore not have repeated the request
for more identification points.
What information has Klarna required to handle the request?
Klarna states that the complainant was asked to provide the following information:
• Name
• Date of birth
• E-mail address
• Invoice number
• Name of a store they previously made a purchase from
• Purchase price for the invoice
Why was the information necessary to confirm the identity of the complainant?
In the present complaint, Klarna has been provided with sufficient identification points
to be able to identify the complainant in the first email (name, email address, date of
birth), and the customer service agent should therefore not have repeated the request
for more identification points.
Swedish Authority Our ref.: IMY-2025-9248 4(6)
for Privacy Protection Date: 2025-12-03
Motivation for the decision
Applicable provisions, etc.
Article 12(2) of the GDPR requires the controller to facilitate the exercise of the data
subject’s rights in accordance with Articles 15 to 22.
Article 12(6) of the GDPR provides that, without prejudice to Article 11 of the GDPR,
where the controller has reasonable doubts as to the identity of the natural person
making a request pursuant to Articles 15 to 21, it may request the provision of
additional information necessary to confirm the identity of the data subject.
According to Article 12(3) GDPR, upon request, the controller shall provide the data
subject, without undue delay and in any event no later than one month after receiving
the request, with information on the measures taken pursuant to Articles 15 to 22. That
period may be extended, if necessary, by a further two months, taking into account the
complexity of the request and the number of requests received. The controller shall
inform the data subject of such an extension within one month of receipt of the
request, stating the reasons for the delay. Where the data subject makes the request
in electronic form, the information shall, where possible, be provided in electronic form,
unless the data subject requests otherwise.
Assessment
Has Klarna acted in accordance with Article 12(6) of the GDPR when Klarna
requested up-to-date information from the complainant?
It is only where the controller has reasonable doubts about the identity of the person
making the request that further information to confirm the identity may be requested.
Klarna states that, in the context of its request, the appellant provided sufficient
identification points to be identified and that, therefore, Klarna had no reason to doubt
the identity of the appellant and to request further information. In view of the fact that
Klarna did not have reasonable grounds to doubt the identity of the complainant and
nevertheless requested additional information for this purpose, IMY concludes that
Klarna has processed the complainant’s data in breach of Article 12(6) GDPR.
Has Klarna facilitated the exercise of the applicant’s right of access under
Article 12(2) of the GDPR?
Article 12(2) of the GDPR requires the controller to facilitate the exercise of the data
subject’s rights in accordance with Articles 15 to 22.
The investigation in the case shows that, in connection with its request, the
complainant has provided sufficient points of identification to be identified.
Nevertheless, Klarna has requested the complainant to provide some additional
information in order to be able to confirm the complainant’s identity and subsequently
handle the complainant’s request for deletion. IMY notes that by requesting additional
information even though it was not necessary to identify the complainant, Klarna made
the exercise of the complainant’s right more difficult. Klarna therefore processed the
applicant’s personal data in breach of Article 12(2) of the GDPR.
Swedish Authority Our ref.: IMY-2025-9248 5(6)
for Privacy Protection Date: 2025-12-03
Has Klarna handled the complainant’s request without undue delay pursuant to
Article 12(3) GDPR?
It is apparent from the investigation in the case that the complainant provided the
necessary data for identification already in connection with the complainant’s request
for erasure on 25 January 2020. However, Klarna states that the erasure of the
applicant’s personal data in accordance with the applicant’s request began only on 16
March 2020. Against this background, IMY concludes that Klarna has not processed
the complainant’s request for deletion without undue delay and at the latest within one
month of receipt of the request. Klarna therefore processed the applicant’s personal
data in breach of Article 12(3) of the GDPR.
Choice of corrective measure
In case of deficiencies, IMY may take certain corrective actions. It follows from Article
58(2) and Article 83(2) of the GDPR that IMY has the power to impose administrative
fines in accordance with Article 83. In the case of a minor infringement, IMY may, as
indicated in recital 148, instead of imposing a fine, issue a reprimand pursuant to
Article 58(2)(b). Account shall be taken of aggravating and mitigating circumstances of
the case, such as the nature, gravity and duration of the infringement and relevant
previous infringements.
IMY notes the following relevant facts. IMY has found that Klarna requested additional
information even though it was not necessary to identify the complainant. IMY has
further noted that Klarna has not facilitated the exercise of the complainant’s right to
erasure and that Klarna has not dealt with the complainant’s request without undue
delay. However, the applicant’s request for erasure was complied with on 29 April
2020. The deficiencies found are therefore less serious than if the request had been
left unanswered.
In the light of the foregoing, IMY considers that these are minor infringements within
the meaning of recital 148 that require Klarna to be reprimanded under Article 58(2)(b)
of the GDPR for the infringements found.
__________________________
This decision has been taken by , Department Lawyer, after a
presentation by the , Legal Advisor.
Appendix
The complainant’s personal data
Copy to
Data Protection Officer
Swedish Authority Our ref.: IMY-2025-9248 6(6)
for Privacy Protection Date: 2025-12-03
How to appeal
If you wish to appeal the decision, you should write to IMY. Indicate in your letter the
decision you wish to appeal and the amendment you are requesting. The appeal must
be received by IMY within three weeks of the date on which you received the decision.
However, if you are a party representing the public, the appeal must be received within
three weeks of the date of notification of the decision. If the appeal has been received
in due time, IMY will forward it to the Administrative Court in Stockholm for
consideration.
You can e-mail the appeal to IMY if it does not contain any privacy-sensitive personal
data or information that may be covered by confidentiality. The contact details of the
authority can be found on the first page of the decision.