Klarna Bank AB – €660,000 Fine (Sweden, 2022)

Klarna Bank AB is a company which provides both credit and non-credit payment solutions to approximately 90 million consumers and more than 200,000 merchants in 17 countries through a variety of financial services, such as direct payment, various forms of "try first and pay later" services and payment through installments, as well as account information services. In order to provide these services, Klarna needs to process large amounts of personal data. The Swedish DPA (IMY) initially examined Klarna's privacy policy, and noted that there was a lack of clarity regarding many aspects, and therefore decided to launch an ex officio investigation to determine Klarna's compliance with the provisions on clear information and communication to data subjects. During the investigation, Klarna continuously changed the information provided on how the company handled personal data. IMY's decision concerns the information as it stood from 17 March to 26 June 2020. After conducting their investigation, the IMY held that Klarna had violated various GDPR provisions related to information on the purpose and legal basis for the processing of personal data, the recipients of various categories of personal data, international data transfers, retention periods, data subject rights and automated decision-making, including profiling. As a common thread, the IMY held that each one of these breaches also entailed a violation of Articles 12(1) GDPR, 5(1)(a) GDPR and 5(2) GDPR. Regarding the information provided by Klarna on the purpose and legal basis for the processing of personal data related to the "My Finance" and "My Economy" services, the IMY held that this information was not concise, clear and easily accessible, and did not meet the requirements of Article 13(1)(c) GDPR. With regards to the recipients, the IMY held that Klarna provided incomplete and misleading information on who were the recipients of different categories of personal data when such data were shared with Swedish and foreign credit reference agencies, in violation of Article 13(1)(e) GDPR. Specifically on the topic of international data transfers, the IMY noted that a mere statement that personal data will be transferred to third countries, without naming these countries, was not adequate information for data subjects in this sense. Moreover, the IMY held that Klarna not only failed to provide information about the countries outside the EU/EEA to which personal data was transferred, but also as to where and how data subjects could access documents regarding the safeguards applicable to the data transfers where no adequacy decision exists between the EU and these countries, in breach of Article 13(1)(f) GDPR. Furthermore, the IMY also held that Klarna provided incomplete information about the periods for which personal data would be retained and the criteria used to determine those periods, in violation of Article 13(2)(a) GDPR. Regarding data subject rights, the IMY held that Klarna did not provide them with adequate information related to the right to erasure of personal data under Article 17 GDPR, restriction of processing concerning the data subject under Article 18 GDPR, the right to object under Article 20 GDPR as well as the right to data portability under Article 21 GDPR, in violation of Article 13(2)(b) GDPR. As to automated decision-making, including profiling under Articles 22(1) and (4) GDPR, the IMY noted that it was not clear whether Klarna used its own internal scoring model based on, among other things, both internal and external financial information, or what types of data are included in the financial information, such as information on liabilities with other creditors. The IMY also observed that no information was provided regarding the logic behind these processes, their significance, the types of personal data that played a decisive role when subject to a negative decision, or the foreseeable consequences for data subjects, in breach of Articles 13(2)(f) and 14(2)(g) GDPR. In order to determine their administrative fine, the IMY took into account that Klarna is a multinational company that processes many different categories of personal data on a large number of data subjects, including privacy-sensitive data such as financial data and creditworthiness, and that these breaches were ongoing for a long period of time. Based on these considerations, the IMY issued a fine of approximately €730,000 (SEK 7,500,000) against Klarna Bank AB.