Klarna Bank AB · Governance finding · severity 2 of 5
On 28 March 2022 Sweden's data-protection authority IMY fined Klarna Bank SEK 7.5 million over the privacy information it gave customers between 17 March and 26 June 2020. One of six findings concerned automated decisions: per IMY, Klarna's notice lacked meaningful information about the logic, significance and consequences of the automated decision-making, including profiling, that it used to approve or decline credit and assess fraud risk, and did not disclose that it used its own internal scoring model. The other findings covered purposes, recipients, third-country transfers, retention and data-subject rights. Klarna appealed, calling the decision unclear; a lower court cut the fine to SEK 6 million in 2023, but the Administrative Court of Appeal restored SEK 7.5 million in March 2024. The automated system was not described as AI.
Record last reviewed Oct 21, 2026 · Markdown
Date
Institution
Country
Sweden
AI system
Internal credit-scoring model and automated credit and fraud decisions · Automated decision-making, including profiling, used to approve or decline credit and to assess fraud risk; not described as AI
AI?
Automated system not described as AI
The system was automated, but neither the institution nor a regulator described it as AI; it is listed because it is routinely discussed as an AI failure.
Category
Status
Regulator finding
Severity
2 of 5
Impact
SEK 7.5 million administrative fine (about $733,000 at the March 2024 rate used by Reuters) · ≈ $733,324 · The notice was published on Klarna's Swedish website; IMY cited the very large number of data subjects it concerned but identified no individual customer harmed by a credit decision.
What happened?
IMY opened its supervision of Klarna on 27 March 2019 by writing to the company about the privacy information on its Swedish website. Klarna revised its notice several times during the case; IMY's assessment covered the version in use from 17 March to 26 June 2020. In that notice Klarna said some decisions in its services were made "uteslutande ... automatiskt, utan inblandning av våra anställda" (solely automatically, without involvement of our staff), including decisions to approve or not approve an application for a service involving credit and decisions on whether a customer posed a fraud or money-laundering risk.[1]
IMY found that the notice said only that certain kinds of information (contact and identity data, financial information and how the customer interacted with Klarna) were used in the automated decision. "Det framgår inte att Klarna använder en egen intern scoremodell som bygger bland annat på både intern och extern finansiell information" (it is not stated that Klarna uses its own internal scoring model based on, among other things, both internal and external financial information), IMY wrote, and "Det ges ingen information om vilka omständigheter som kan vara av avgörande betydelse för ett negativt kreditbeslut" (no information is given about which circumstances can be decisive for a negative credit decision).[1]
IMY held that meaningful information about the logic of an automated credit decision includes the categories of data that are decisive within an internal scoring model and any conditions that always lead to a rejection, and that the information was spread across the notice rather than given in one place. It concluded that Klarna breached Articles 5(1)(a), 5(2), 12(1), 13(2)(f) and 14(2)(g) GDPR on automated decision-making, alongside separate breaches on the purpose and legal basis of its "Min Ekonomi" service, recipients at credit-reference agencies, third-country transfers, retention periods and data-subject rights.[1]
IMY set one fine for the whole notice. It took Klarna Holding's 2020 turnover of about SEK 10.1 billion as the basis, giving a maximum of about SEK 404 million, treated the size of the affected population and the duration as aggravating, credited Klarna for improving the notice during the case, and fixed the fine at SEK 7.5 million.[1]
Klarna appealed. According to IMY's case page, the Administrative Court in Stockholm partly upheld the appeal on 14 April 2023 and reduced the fine to SEK 6 million; IMY appealed, and the Administrative Court of Appeal granted IMY's appeal, set the fine back at SEK 7.5 million and rejected Klarna's appeal. Reuters reported the appeal ruling on 11 March 2024, saying the court found the information unclear or difficult to access.[2][4][5]
When did it happen?
- Mar 27, 2019
IMY opens supervision of Klarna's privacy information with a letter of questions.[1]
- Mar 28, 2022
IMY finds that Klarna's 2020 privacy notice breached GDPR, including on automated credit decisions, and fines Klarna Bank SEK 7.5 million.[1][2]
- Mar 29, 2022
Klarna says it will appeal, calling the decision unclear and saying the findings are no longer relevant to its current notice.[3]
- Apr 14, 2023
The Administrative Court in Stockholm partly upholds Klarna's appeal and cuts the fine to SEK 6 million.[2]
- Mar 11, 2024
The Administrative Court of Appeal grants IMY's appeal and restores the SEK 7.5 million fine.[2][4]
What was the impact?
- Financial: SEK 7.5 million administrative fine (about $733,000 at the March 2024 rate used by Reuters) · ≈ $733,324[1][4]
- Customers: The notice was published on Klarna's Swedish website; IMY cited the very large number of data subjects it concerned but identified no individual customer harmed by a credit decision.[1][4]
Severity 2 of 5: A regulatory finding with a SEK 7.5 million fine (under $1m) for transparency failures in a privacy notice; no discriminatory outcome, customer loss or wrongful decision was found, and the fine was upheld on appeal.
How did Klarna Bank AB respond?
Klarna said on 29 March 2022 that it would appeal for two main reasons: that the decision was unclear and did not explain why the information was deficient enough to justify a fine, and that an appeal could give guidance on how GDPR should be implemented. It said the investigation concerned only its privacy policy, not how it collects or handles data, that it had updated the policy 11 times since the reviewed version, and that it was setting up a dedicated team to improve its data-protection information. After the 2024 appeal ruling a Klarna spokesperson told Reuters it was "too early to comment", Finextra reported.[3][5]
What was the outcome, and did regulators act?
The SEK 7.5 million fine stands after the Administrative Court of Appeal's March 2024 judgment, which restored IMY's original amount. IMY's decision did not order changes to Klarna's credit model itself; it concerned the information given to customers, which Klarna had already revised during the case.[1][2][4]
Why did Sweden's IMY fine Klarna in 2022?
IMY fined Klarna Bank SEK 7.5 million because its 2020 privacy notice breached GDPR transparency rules in six respects. One finding was that it gave no meaningful information about the logic behind automated credit and fraud decisions or that it used an internal scoring model.
Was Klarna's credit-decision system described as AI?
No. IMY described automated decision-making, including profiling, and an internal scoring model that drew on internal and external financial data. Neither the regulator nor Klarna called it artificial intelligence, so this register classes it as an automated system not described as AI.
Did Klarna win its appeal against the IMY fine?
Only briefly. The Administrative Court in Stockholm cut the fine to SEK 6 million in April 2023, but on IMY's appeal the Administrative Court of Appeal restored the full SEK 7.5 million in March 2024 and rejected Klarna's own appeal, according to IMY and Reuters.
Were any Klarna customers wrongly refused credit?
The decision does not say so. IMY assessed only the information in Klarna's privacy notice, not whether individual credit decisions were correct, and it expressly did not rule on whether Klarna's other personal-data processing complied with GDPR.
- Beslut efter tillsyn enligt dataskyddsförordningen – Klarna Bank AB (DI-2019-4062) official
- Klarna Bank AB, bristande information official
- Kommentar gällande IMY:s beslut official
- Sweden's Klarna fined $733,000 over insufficient GDPR information news
- Court tells Klarna to pay $733,000 over GDPR failings news
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning