What happened
The authority found that Klarna Bank AB had processed personal data contrary to Article 12(3) by not meeting an access request without undue delay, and issued a reprimand under Article 58(2)(b). The request arrived by email on 5 Jan 2019 at an address other than the one the company points to for data protection matters, so it was not handled under the company's internal routine; the information and the copy were sent on 18 Jun 2019, more than five months after the first request, and the requester was not informed of the delay. The authority held that the company handling a large number of requests, and answering follow up questions promptly, did not change that assessment. On a second complaint it found no breach, the request there having been met within a fortnight, with the company asking for an alternative address once told the answer had not arrived.
What changes at the desk
Any address you publish is an address a request can arrive at, and the month starts when it does rather than when it reaches the team that handles these. Route anything that reads like a request into one queue on the day it lands, whichever mailbox took it. If you are going to need the extension, claim it inside the first month and give the reason, because it cannot be claimed afterwards, and volume is not on its own a reason an authority will accept.
Primary source
DecisionSweden31 Mar 2021
Elsewhere on the record
Entries from the same jurisdiction, or on the same kind of document. Each one links the text it was written from, as this one does.
- Read the entry
A copy is only as complete as the systems that were searched
Sweden29 Jun 2023
- Read the entry
The only party left holding the data was the controller, whatever its contract said
Norway16 Jan 2026
- Read the entry
A form for every register, and an identity document, were both too much
Finland2 Apr 2025