KamR Stockholm - 2829-23

KamR Stockholm - 2829-23
Court:	KamR Stockholm (Sweden)
Jurisdiction:	Sweden
Relevant Law:	[[Article 1 GDPR#2|]] [[Category:]] Article 5(1)(a) GDPR Article 5(2) GDPR Article 12(1) GDPR Article 13 GDPR Article 13(1)(e) GDPR Article 13(1)(c) GDPR Article 13(1)(f) GDPR Article 13(2)(a) GDPR Article 13(2)(b) GDPR Article 13(2)(f) GDPR Article 14(2)(g) GDPR [[Article 15 GDPR|]] [[Category:]]
Decided:	11.03.2024
Published:	11.03.2024
Parties:	Klarna Bank AB IMY
National Case Number/Name:	2829-23
European Case Law Identifier:
Appeal from:	Administrative Court of Stockholm (Sweden) 7679-22
Appeal to:	Not appealed
Original Language(s):	Swedish
Original Source:	Kammarrätten i Stockholm (in Swedish)
Initial Contributor:	inkg

The Administrative Court of Appeal raised the administrative fine back to €730,000 (SEK 7,300,000) for Klarna Bank AB's insufficient and incomplete privacy policy.

English Summary

Facts

On 28 March 2022, the Swedish DPA ("IMY") fined Klarna AB ("the controller") €730,000 (SEK 7,300,000) for not providing data subjects with adequate information related to their processing activities. The DPA found that the controller violated the GDPR in several respects.

The controller appealed the DPA's decision to the Administrative Court of Stockholm ("FiS"). The Administrative Court upheld the controller's appeal in part and lowered the administrative fine to €600,000 (SEK 6,000,000) because the violations did not cause considerable harm and were not intentional and the controller had improved its information.

The DPA appealed this decision to the Administrative Court of Appeal of Stockholm ("KamR Stockholm"), requesting the fine to be raised back to €730,000 (SEK 7,300,000).

Holding

The Court reviewed the entire appealed decision to decide whether the controller should be fined on the grounds put forward by the DPA. The Court therefore reviewed whether the controller provided complete or sufficient information and fulfilled the requirements on how it should be provided on different aspects of the controller’s privacy policy under Article 12 GDPR, Article 13 GDPR and Article 14 GDPR.

The Court agreed with the Administrative Court that the controller failed to provide information on safeguards for third country transfers (Article 13(1)(f) GDPR) and the use of a scoring model and the data processed in it (Article 14(2)(g) GDPR). Moreover, the Court found that the controller did not provide information on automated decision-making in such an easily accessible form as required by Article 12(1) GDPR. The Court considered that the fact that the information was spread over different sections, did not necessarily mean that the information is difficult to access by data subjects. However, the Court found that the references to different sections made the information not easily accessible as it was difficult to identify then what the relevant information was in the referred sections.

On whether the information on the right to erasure, restriction and data portability in the privacy policy was designed in accordance with Article 12(1) GDPR, the Court held that the privacy policy sufficiently informed data subjects about the existence of the right to erasure and no further information is required under Article 13(1)(b) GDPR. However, the Court did find that the information about the right to data portability was provided in such a way that it was difficult to understand that it is a separate right. Moreover, the right to restriction was expressed in the information as "oppose" and "stop processing", using different terminology than the GDPR, which creates obscurity. Due to these ambiguities, the Court found that the controller violated Article 12(1) GDPR.

The Court also examined whether the controller provided the information on both the purpose and the legal basis of the My Economy service in the privacy policy in a too scattered manner and with unclear references. Although the Court, unlike the DPA, did not find that the information legal basis was unclear, the Court did find that the way that the information on the purpose referred to different documents was difficult to access and unclear. Thus, the Court held that the controller violated Article 12(1) GDPR in regards to the information on the purpose of the My Economy service.

The Court took into account that the information concerned a large number of data subjects and that the shortcomings related to information based on articles that are central to the data subjects. Moreover, the Court recognised that the breaches did not take place for a long time and the privacy policy had been continuously improved. Moreover, taking into account the controller’s argument that the DPA’s case took unreasonably long and that the controller’s right to be informed without delay of the significance of and grounds for the accusations was violated, the Court did not see a reason to reduce the fine on the basis of Article 83(2) GDPR and Article 6(1) and 6(3)(a) ECHR.

Thus, the Court held that for an effective, proportionate, and dissuasive measure, the violations justified an administrative fine of €730,000 (SEK 7,300,000), which was the maximum amount according to the penalty framework in the case, and upheld the DPA’s appeal.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.

Klarna must pay a penalty fee of SEK 7.5 million because the data protection information did not meet the requirements of the EU's data protection regulation.

The violations of the data protection regulation consist of Klarna not providing sufficient information to the data subjects, for example, about how personal data will be stored, and that the information was difficult to access or unclear.
- The Court of Appeal considers that a penalty fee of SEK 7.5 million is justified to be effective, proportionate and dissuasive. The Court of Appeal thus makes the same assessment as the Swedish Privacy Protection Authority, says Peder Liljeqvist, a lawyer at the Court of Appeal.
The Court of Appeal thus changes the administrative court's ruling that the sanction fee would be SEK 6 million.