Data protection watchdog to investigate Klarna over marketing emails

The ‘buy now, pay later’ service Klarna is to be investigated by the UK’s data protection watchdog after it sent out marketing emails to people who had never even used it before.

The Information Commissioners’ Office said it was ‘making enquiries’ into the £8.22billion Swedish firm with 8.6million UK customers after receiving more than 90 complaints from people who received its weekly deals email on Monday.

Klarna subsequently apologised in a follow-up email, saying the newsletter was sent by mistake and those who had wrongly received it ‘have not been added to a marketing database’.

Since tighter data protection rules came into force in 2018 consumers must explicitly opt in to receiving marketing emails.

Klarna said the email was sent to customers who ‘have recently used one of Klarna’s products or services including Klarna’s checkout technology’, which requires customers to opt into its privacy policy and hand over data including their name, email address and date of birth, as well as their payment details.

But it emerged that shoppers who had never used the ‘buy now, pay later’ service had also handed their details over to Klarna when they had made purchases elsewhere, as the Swedish fintech processes credit and debit card transactions for other retailers.

A spokesperson told This is Money: ‘Klarna’s checkout technology is a product some retailers use to process payments on their website.

‘This means that Klarna processes all credit and debit card transactions for these retailers. Whenever anyone uses Klarna’s checkout technology they agree to the terms and conditions and our privacy notice, which allows Klarna to promote its products and services to them.

‘While the newsletter was sent in error, all recipients had accepted our terms and conditions and privacy notice when either using a Klarna method of payment or when purchasing from a retailer that uses Klarna Checkout technology. 

‘No-one who had actively opted out of receiving our marketing communications received the newsletter.’

But although it said no one who had actively opted out was contacted on Monday, the ICO said that businesses ‘should only contact individuals for electronic marketing purposes where consent has been provided or, in limited circumstances, where they have an existing relationship with a customer.’ 

One person who received the email told This is Money: ‘Although I don’t know how many marketing emails Klarna send, I’ve checked my inbox and it’s the first marketing email I’ve ever received from them, so I think if I’d accidentally wound up on their list through my own incompetence I would have realised before now with all the emails.

‘A search for Klarna just brings up emails from two shops who use them for payments and from whom I’ve ordered.’

They added: ‘I had definitely not signed up to their marketing list. I have bought from other sites that use their payments but I think once I accidentally used their delayed pay facility because I clicked the wrong box, not knowing what it was – ever since then I have been careful to make sure I am paying immediately.

‘However, even if that somehow puts me into a different category it still shouldn’t allow them to send marketing without opt in consent.’

The wrongly sent email sparked the second social media backlash against Europe’s most valuable fintech firm in three weeks, after a bungle between it and two high street retailers led to thousands of people missing out on the new Microsoft Xbox despite being credit checked for financing.

Shoppers are able to make a subject access request to Klarna to find out the data it has on them, how they got hold of it and where it is being shared, while the ICO also said they can object to their data being used for marketing services.

It said: ‘The right to object to direct marketing is stronger than any objections you can make about other uses of your data.

‘If you object, the organisation cannot refuse your objection and must stop using your data for direct marketing purposes. For example, they cannot carry on using your data to try to sell or promote things to you.

‘If you’re able to object, you should inform the organisation directly that you don’t want them to process your data. You need to explain why you believe the organisation should stop using your data in this way.’

The ICO offers guidance on how to make a subject access request and how to object to a use of personal data on its website.