Klarna Bank – Complaint Upheld (Sweden, 2022)

The data subject and partner had each used a Swedish payment provider (controller) multiple times over the span of a few years for online shopping. However, the controller had made the mistake of addressing the wrong person in the invoice more than once. The controller would use the first name of the data subject, while the partner had made the purchase. According to the data subject, in December 2018, the first rectification request was filed to request the controller to correct the names in the e-mails, because the partner had received invoices with the name of the data subject. The controller's services were then not used for some time by the data subject and partner. When the data subject's partner started using the controller's service again sometime in 2020, he received another e-mail, which was addressed to the data subject (first name only). After this, the data subject filed the second rectification request to request the controller to change the first names in the e-mails. On 15 October 2020, the data subject also submitted an access request, to which the controller never responded. The data subject filed a complaint at a German DPA (not clear which German DPA and not clear when the complaint was filed), which transferred the complaint to the Swedish DPA, which was the lead supervisory authority in this decision. The concerned supervisory authorities were the DPA's of Denmark, Finland, Germany, France, Norway and the Netherlands. The Swedish DPA started an investigation into the controller. During the investigation of the DPA, the controller informed the DPA that it had an automatic system in place which would generate the first name in the initial greetings of an email, which was apparently based on previous information provided by its clients. In this context, the controller also provided the DPA with the information that the data subject and partner had both separately used the same email address ('e-mail address Y'), which contained the partner's n