{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"3da8fec6-fc2d-4e26-8901-ca7e27ab6572","screeningDate":"2026-09-23T17:22:15.577Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"0fed73f4-ac93-4699-9d66-dd65ab6780cc","name":"Privacy Notice","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.klarna.com/ie/privacy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-09-23T17:22:15.560Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":3,"sha256":"d8dab3dd70c2134d9b617c931456343b470d2e05b7d10a888147002e178be387","capturedAt":"2026-08-18T02:27:22.862Z"},"current":{"version":4,"sha256":"10b150f31d6e4e60502364e866a4f9e7750df8d0d7baf1c91d047b6e1b63b241","capturedAt":"2026-09-23T17:22:15.566Z"}},"assessment":{"summary":"Klarna's Privacy Notice update clarifies that it collects data from external bank accounts, improving transparency without adding new data types.","overallRisk":"Medium","overallScore":6,"previousPublicChange":{"id":"e5b60963-4f7d-4396-97b2-b0a1f263fc80","overallRisk":"Medium","overallScore":5,"screeningDate":"2026-07-10T01:48:59.366Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"info","textEn":"Clarified external bank data collection improves transparency.","textIt":"La chiarezza sulla raccolta di dati bancari esterni migliora la trasparenza.","deltaScore":-1,"evidenceQuote":"external bank account number","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Extensive collection of financial and service-specific data.","textIt":"Ampia raccolta di dati finanziari e specifici del servizio.","deltaScore":0,"evidenceQuote":"Payment information - Credit and debit card details (card number, expiry date and CVV code), external bank account number, bank name, external bank account holder name, bank login details.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Policy allows processing of sensitive personal data with explicit consent.","textIt":"La policy consente il trattamento di dati personali sensibili con consenso esplicito.","deltaScore":0,"evidenceQuote":"If the service processes information that constitutes sensitive personal data (e.g., from materials you choose to upload), our processing takes place based on your explicit consent (Article 9(2)(a) GDPR).","evidenceSide":"new","relatedKpi":"kpiConsentMechanism","anchorStatus":"verified"}],"keyPoints":[{"textEn":"Klarna now explicitly states it collects data from \"external\" bank accounts for payments and financial insights.","textIt":"Klarna dichiara esplicitamente di raccogliere dati da conti bancari \"esterni\" per pagamenti e analisi finanziarie.","sentiment":"neutral"},{"textEn":"The update improves transparency regarding the source of certain financial data.","textIt":"L'aggiornamento migliora la trasparenza riguardo alla fonte di alcuni dati finanziari.","sentiment":"positive"},{"textEn":"No new categories of personal data are introduced in this policy revision.","textIt":"Nessuna nuova categoria di dati personali è stata introdotta in questa revisione della policy.","sentiment":"neutral"},{"textEn":"Users retain existing GDPR rights, including deletion and objection to automated decisions.","textIt":"Gli utenti mantengono i diritti GDPR esistenti, inclusi cancellazione e opposizione a decisioni automatizzate.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"For EU enterprises, this update reinforces the importance of clear data source disclosure, aligning with GDPR transparency requirements. No new compliance burdens are introduced.","complianceNoteEn":"GDPR Art 5"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The clarification on \"external\" bank accounts slightly improves transparency for EU users under GDPR. However, extensive data collection still warrants careful review.","complianceNoteEn":"GDPR Art 13, 14"},{"region":"Global","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"Global enterprises can view this as a minor positive step towards clearer privacy communication, setting a standard for international operations.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, users gain slightly better understanding of how Klarna handles their financial data. The policy's extensive data collection remains a key privacy consideration.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Low","impactAnalysisEn":"US enterprises should note the improved transparency as a best practice for consumer trust, especially concerning financial data. No specific new US regulatory impact.","complianceNoteEn":"FTC Guidelines"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"US individuals benefit from the increased clarity regarding financial data sources, aligning with general privacy expectations. Rights under CCPA/CPRA are comparable for data access.","complianceNoteEn":"CCPA/CPRA Transparency"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Notice source still match the recorded public snapshot version 4?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/3da8fec6-fc2d-4e26-8901-ca7e27ab6572","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"5e32e75f2c0a95d7d9627c4052f431ad4a694c4a474a7357cdb9fc48bc4043ca"}