What happened
The authority found that Klarna Bank AB had processed personal data contrary to Article 12(3) by not meeting an access request without undue delay, and issued a reprimand under Article 58(2)(b). The request arrived by email on 5 Jan 2019 at an address other than the one the company points to for data protection matters, so it was not handled under the company's internal routine; the information and the copy were sent on 18 Jun 2019, more than five months after the first request, and the requester was not told of any extension. The authority held that the company handling a large number of requests, and answering follow up questions promptly, did not change that assessment. On a second complaint it found no breach, the request there having been met within a fortnight, with the company asking for an alternative address once told the answer had not arrived.
What changes at the desk
Any address you publish is an address a request can arrive at, and the month starts when it does rather than when it reaches the team that handles these. Route anything that reads like a request into one queue on the day it lands, whichever mailbox took it. If you are going to need the extension, claim it inside the first month and give the reason, because it cannot be claimed afterwards, and volume is not on its own a reason an authority will accept.
Primary source
DecisionSweden31 Mar 2021
This entry is a draft. No practitioner has reviewed it, and it should be read against the document it names rather than relied on as advice.