The Klarna ruling clarifies the requirements surrounding the obligation to provide information according to GDPR

Not necessary to provide information about the identity of recipient countries in connection with third country transfers

According to GDPR, the personal data controller is obliged to inform data subjects when it intends to transfer personal data to countries outside the EU/EEA. One issue in the Klarna case was whether this obligation also constitutes a requirement to state which third countries personal data is being transferred to. In its ruling, the Administrative Court found that Klarna did not fulfil the information requirements according to GDPR, as Klarna had not indicated in its disclosures the specific third countries to which personal data was being transferred. However, the Administrative Court of Appeal arrived at an alternative assessment and found that GDPR's requirements for disclosure in connection with third country transfers did not include having to specify third countries in privacy policies or similar documents.

Sufficient that data subjects are made aware of their rights

GDPR also stipulates that data subjects must be informed of their rights according to GDPR, such as the right to access to and correction and deletion of their personal data. The Administrative Court interpreted this requirement that the personal data controller must provide the data subject with such information that makes it possible for the data subject to understand the rights' significance and utilise those rights. However, the Administrative Court of Appeal also arrived at an alternative assessment on this point and finds that it is sufficient that data subjects are made aware of their rights according to GDPR, without provision of a more detailed description of the rights' significance.

Important to continue monitoring legal developments

The Administrative Court of Appeal's ruling in the Klarna case is of particular significance as it is more nuanced than the Administrative Court's previous assessments of the personal data controller's obligation to provide information according to GDPR. However, even though this ruling has now gained legal force, it cannot be viewed as guiding; the final interpretation of GDPR's provisions, including those concerning the personal data controller's obligation to provide information, lie with the European Court of Justice. Personal data controllers and others concerned must consequently continue to carefully monitor legal developments in the area.

If you would like to discuss how the Klarna ruling might potentially affect your business and how Lindahl can assist you with adaptation to GDPR's requirements, you are welcome to contact Mårten Lindberg or Josefin Tegnvallius Boklund.