Certain personal data is by its nature particularly sensitive and therefore it has stronger protection under privacy laws (for example the GDPR in Europe, or the California Consumer Privacy Act in the United States). This type of data, called special categories of data or sensitive personal data, can be data that concerns racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union, health, a person’s sex life or sexual orientation, genetic data and biometric data that uniquely identifies a person.
In general, processing of sensitive data is prohibited. There are however a number of exceptions; e.g. if the subject has consented to the processing of sensitive personal data. Do however note that there are specific requirements in relation to a valid consent under the GDPR.
In the cooperation between Klarna and the merchant, each party will process certain personal data. That processing is by each party done in the capacity of a data controller, being responsible for its own processing. However, the parties will also share certain personal data with each other.
If you are processing personal data which could be categorized as sensitive data, you have to make sure not to share that data with Klarna. As information regarding what goods the consumer has purchased normally is shared with Klarna, you have to make sure that, to the extent the information is deemed sensitive data, names of goods are anonymized before that information is shared with Klarna.
Medical and pharmaceutical products may include goods which can reveal the health or sex life of a person. Therefore, you should never send any line item data regarding products that may reveal the health or sex life of a person, which includes, but is not limited to, products that have a package leaflet which is regulated under the relevant implementation of the Directive 2001/83/EC of 6 November 2001 on the Community code relating to medicinal products for human use or similar local regulations. This means you should never send any such line items. Instead of providing line item data for such products, you should blank out the name of the goods, or as a suggestion simply state that ‘pharmaceutical goods’ were purchased.
You should never send any line item data that could reveal details about someone’s sex life or sexual orientation. If you are sending any line item data regarding products that can reveal details about a person’s sex life or sexual orientation, you should blank the item out or state ‘sensitive item’ or similar.
You should never share data with us that reveals an individual’s political opinions, religious or philosophical beliefs, or trade union membership. If you are sending line item data regarding products that can reveal details about a person’s political opinions, religious or philosophical beliefs, or trade union membership you should blank the item information out or state ‘sensitive item’ or similar.