IMY has now finished an investigation of Klarna Bank AB (Klarna). The authority has examined how the company on its website informs about how it processes personal data in accordance with the GDPR.
– Klarna is a financial company that processes personal data about many people and in many different ways. It is important that the information that Klarna provides about how the company processes personal data is correct and as complete as possible. Here we have seen shortcomings, says lawyer Hans Kärnlöf who led the investigation.
During the investigation, Klarna has continuously changed the information provided on how the company handles personal data. IMY's decision concerns the information provided in the spring of 2020. In its decision, IMY states that Klarna did not then provide information on the purpose for which and on the basis of which legal basis personal data was processed in one of the company's services. The company also provided incomplete and misleading information about who were the recipients of different categories of personal data when data was shared with Swedish and foreign credit information companies.
Klarna also did not provide information on to which countries outside the EU/EEA personal data were transferred or on where and how individuals could obtain information on the safeguards that applied to the transfer to third countries. IMY also notes that the company provided incomplete information about the data subjects' rights, including the right to delete data, the right to data portability and the right to object to how one's personal data is processed.
IMY issues an administrative fine against Klarna of SEK 7,500,000 for the deficiencies discovered during the investigation.