IMY (Sweden) - IMY 2023-8336

From GDPRhub
Revision as of 11:07, 28 February 2024 by Mg (talk | contribs) (→‎Facts)
IMY - IMY 2023-8336
LogoSE.png
Authority: IMY (Sweden)
Jurisdiction: Sweden
Relevant Law: Article 5(1)(d) GDPR
Article 12(2) GDPR
Article 16 GDPR
Article 25 GDPR
Article 56 GDPR
Article 58(2)(b) GDPR
Type: Investigation
Outcome: Violation Found
Started:
Decided: 09.01.2024
Published: 09.01.2024
Fine: n/a
Parties: Klarna Bank AB
National Case Number/Name: IMY 2023-8336
European Case Law Identifier: n/a
Appeal: n/a
Original Language(s): Swedish
Original Source: IMY (in SV)
Initial Contributor: Maximilien Hjortland

The DPA reprimanded Klarna Bank for not enabling a data subject in Germany to rectify their email address linked to their payment card.

English Summary

Facts

The controller, Klarna Bank AB, commonly referred to as Klarna, is a Swedish fintech company that provides online financial services. The company provides payment processing services for the e-commerce industry, managing store claims and customer payments. The company is a "buy now, pay later" service provider.[1]

A Klarna Bank AB customer in Germany contacted the controller in June 2020 to rectify their registered email address as per Article 16 GDPR.

Klarna’s customer service initially replied to the customer that changing the email address was technically impossible as it was associated with the claimant’s card, and encouraged them to order a new card to change their email address. A new Klarna card would however influence the claimant’s credit standing.

In July 2020, the claimant requested the deletion of their personal data including the destruction of the Klarna card. A customer service employee informed the data subject that their email address had been changed for their unsettled invoices.

Klarna stated that email addresses were used as personal identifiers, and as part of a verification process, which is why the controller needed to issue a new payment card to update the email address.

The data subject complained to a German supervisory authority about the inadequate fulfilment of their right to rectification in Article 16 GDPR. On the basis of Article 56 GDPR the complaint was passed on to Swedish DPA ('IMY') as the lead SA.

Holding

The Swedish DPA held that the controller processed personal data in violation of:

1) Article 12(2) GDPR, by not enabling the data subject to exercise their right to rectification stated in Article 16 GDPR

2) and Article 16 GDPR, by not enabling the data subject to change their email address as requested.

Based on Article 25 GDPR, the lead SA argued that the controller had design flaws in its product resulting in the unnecessary complication of rectification. It also emphasised the infringement of the principle of accuracy in Article 5(1)(d) GDPR, because process information was inaccurate and rectification delayed.

The Swedish DPA decided to reprimand Klarna Bank AB based on Article 58(2)(b) and Recital 148 for a minor infringement.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Swedish original. Please refer to the Swedish original for more details.


  1. See Wikipedia for more information.