Klarna Bank AB – €660,000 Fine (Sweden, 2022)

Klarna Bank AB is a company which provides both credit and non-credit payment solutions to approximately 90 million consumers and more than 200,000 merchants in 17 countries through a variety of financial services, such as direct payment, various forms of "try first and pay later" services and payment through installments, as well as account information services. In order to provide these services, Klarna needs to process large amounts of personal data. The Swedish DPA (IMY) initially examined Klarna's privacy policy, and noted that there was a lack of clarity regarding many aspects, and therefore decided to launch an ex officio investigation to determine Klarna's compliance with the provisions on clear information and communication to data subjects. During the investigation, Klarna continuously changed the information provided on how the company handled personal data. IMY's decision concerns the information as it stood from 17 March to 26 June 2020. After conducting their investigation, the IMY held that Klarna had violated various GDPR provisions related to information on the purpose and legal basis for the processing of personal data, the recipients of various categories of personal data, international data transfers, retention periods, data subject rights and automated decision-making, including profiling. As a common thread, the IMY held that each one of these breaches also entailed a violation of Articles 12(1) GDPR, 5(1)(a) GDPR and 5(2) GDPR. Regarding the information provided by Klarna on the purpose and legal basis for the processing of personal data related to the "My Finance" and "My Economy" services, the IMY held that this information was not concise, clear and easily accessible, and did not meet the requirements of Article 13(1)(c) GDPR. With regards to the recipients, the IMY held that Klarna provided incomplete and misleading information on who were the recipients of different categories of personal data when such data were shared with Swedish