Cybersecurity Policy Report, Swedish Court Reinstates Fine Against Bank Over GDPR Violations, (Mar 11, 2024)

By Tony Foley

A Swedish appellate court announced today that it had reinstated a fine of 7.5 million kroner ($732,000) against Klarna Bank AB based on a variety of violations of the European Union’s General Data Protection Regulation (GDPR).

Background. In March 2022, the Swedish Privacy Protection Authority imposed the fine, finding that Klarna failed to disclose the purpose of its data collection and the legal basis for such collection. It also provided incomplete and misleading information about the recipients of different categories of personal data when shared with specified credit information companies, failed to provide information on the countries outside the EU to which personal data were transferred, and provided insufficient information to data subjects about their rights under the GDPR (CPR, March 20, 2022).

Appellate ruling. According to a news release from the Court of Appeal in Stockholm announcing its decision, an administrative court had earlier reduced the authority’s fine from 7.5 million kroner to 6 million kroner ($585,000). The appellate court’s decision, which may be obtained via an order form included in the announcement, considered the authority’s original fine amount to be justified as effective, proportionate and dissuasive under the GDPR’s penalty provisions.

News: LitigationEnforcement DataPrivacy DataSecurity GDPR