Klarna Bank AB – Court Ruling (Sweden, 2024)

On 28 March 2022, the Swedish DPA ("IMY") fined Klarna AB ("the controller") €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. The DPA found that the controller violated the GDPR in several respects. The controller appealed the DPA's decision to a court of first instance, the Administrative Court of Stockholm ("FiS"). The Administrative Court upheld the controller's appeal in part and lowered the administrative fine to €600,000 (SEK 6,000,000) because the violations did not cause considerable harm and were not intentional and the controller had improved its information. The DPA appealed this decision to a court of appeal, the Administrative Court of Appeal of Stockholm ("KamR Stockholm"), requesting the fine to be raised back to €730,000 (SEK 7,300,000). The court of appeal, reviewed the entire appealed decision to decide whether the controller should be fined on the grounds put forward by the DPA. The Court therefore reviewed whether the controller provided complete or sufficient information on different aspects in their privacy policy and if they fulfilled the requirements on how it should be provided under Article 12 GDPR, Article 13 GDPR and Article 14 GDPR. The court of appeal disagreed with the court of first instance on whether the controller infringed Article 13(1)(f) GDPR by not indicating the specific countries to which personal data is transferred. The court of appeal found that the GDPR does not require that the specific third countries must be named. Therefore, the Court held that the controller did not violate Article 13(1)(f) GDPR by not specifying the third countries in their privacy policy. Moreover, the court of appeal disagreed with the court of first instance on whether the information provided by the controller on the rights of data subjects fulfilled the requirements of Article 13(2)(b) GDPR. This Article requires the controller to inform the data subject of the existence of the right to request from the controller access to and rectification or erasure of personal data or restriction of processing concerning him or her, or to object to processing, and of the right to data portability. The court of appeal held that the wording of the provision does not indicate anything other than that the data subject must be informed of the existence of the rights. The court of appeal found that there is nothing to suggest that the controller, in addition to informing the data subject of the existence of the rights listed in Article 13(2)(b) GDPR, is obliged to describe the meaning of the rights in more detail. Therefore, unlike the court of first instance, the court of appeal found that the controller did not violate Article 13(2)(b) GDPR in that respect. The court of appeal agreed with the court of first instance that the controller failed to provide information on safeguards for third country transfers (Article 13(1)(f) GDPR) and the use of a scoring model in their automated decision-making and how the data was processed in it (Article 14(2)(g) GDPR). Thus, the court of appeal held that the controller violated Article 13(1)(f) GDPR and Article 14(2)(g) GDPR regarding these two elements of the privacy policy. Moreover, the court of appeal found that the controller did not provide information on automated decision-making in such an easily accessible form as required by Article 12(1) GDPR. The court of appeal considered that spreading information over different sections does not necessarily mean that the information is difficult to access by data subjects. However, the court of appeal found that the information on automated decision-making in the privacy policy referred to different sections of the privacy policy which made the information not easily accessible as it was difficult to identify what the relevant information was in the referred sections. The court of appeal also found that the information about the right to data portability was provided in such a way that it was difficult to understand that it is a separate right. The right to restriction was also expressed in the privacy policy as "oppose" and "stop processing". This was different terminology than the GDPR and created obscurity according to the court of appeal. Due to these ambiguities, the court of appeal found that the controller violated Article 12(1) GDPR. Given this new legal assessment, the court of appeal evaluated the appropriateness of the fine. As a mitigating factor, the court of appeal recognised that the breaches did not take place for a long time and the privacy policy had been continuously improved. However, the court of appeal took into account that the information concerned a large number of data subjects and that the shortcomings related to information based on articles that are fundamental to the data subjects. Finally, the court of appeal dismissed the controller’s argument that the DPA’s case took unreasonably long and that the controller’s right to be informed without delay of the significance of and grounds for the accusations was violated. Thus, the court of appeal did not see a reason to reduce the fine on the basis of Article 83(2) GDPR and [https://fra.europa.eu/en/law-reference/european-convention-human-rights-article-6 Article 6(1) and 6(3)(a) ECHR]. Thus, the court of appeal held that for an effective, proportionate, and dissuasive measure, the violations justified an administrative fine of €730,000 (SEK 7,300,000), which was the maximum amount according to the penalty framework in the case, and upheld the DPA’s appeal.