{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"71c0131c-38e2-4ac6-8a81-8adac2a16bc0","screeningDate":"2026-10-01T19:54:08.649Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"0fed73f4-ac93-4699-9d66-dd65ab6780cc","name":"Privacy Notice","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.klarna.com/ie/privacy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-10-01T19:54:08.629Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":4,"sha256":"10b150f31d6e4e60502364e866a4f9e7750df8d0d7baf1c91d047b6e1b63b241","capturedAt":"2026-09-23T17:22:15.566Z"},"current":{"version":5,"sha256":"134b8c6bfca5db2cb7d8c772a4315ffeae394bb4d9e289ae7487a80cbaa20b42","capturedAt":"2026-10-01T19:54:08.636Z"}},"assessment":{"summary":"Klarna now collects more financial details like dependents and employment status, plus device call state, increasing overall data collection.","overallRisk":"High","overallScore":7,"previousPublicChange":{"id":"3da8fec6-fc2d-4e26-8901-ca7e27ab6572","overallRisk":"Medium","overallScore":6,"screeningDate":"2026-09-23T17:22:15.577Z"},"scoreDelta":1,"direction":"higher","reasons":[{"icon":"warning","textEn":"New collection of sensitive financial data points.","textIt":"Nuova raccolta di punti dati finanziari sensibili.","deltaScore":2,"evidenceQuote":"Information about, for example, your income, the number of your dependents, any credits, negative payment history, previous credit approvals, and your employment status.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"warning","textEn":"Added collection of device 'call state' data.","textIt":"Aggiunta la raccolta dei dati sullo 'stato della chiamata' del dispositivo.","deltaScore":1,"evidenceQuote":"Device ID, IP address, Mobile ID (MAID), language settings, browser settings, time zone, operating system, platform, call state, screen resolution and similar information about your device and device settings/usage.","evidenceSide":"new","relatedKpi":"kpiDataCollection","anchorStatus":"verified"},{"icon":"info","textEn":"Overall expansion of personal data types collected.","textIt":"Espansione complessiva dei tipi di dati personali raccolti.","deltaScore":1,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":"kpiDataCollection","anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Klarna expanded financial data collection to include 'number of dependents' and 'employment status'.","textIt":"Klarna ha ampliato la raccolta di dati finanziari includendo 'numero di persone a carico' e 'stato occupazionale'.","sentiment":"negative"},{"textEn":"Device information now includes 'call state', adding a new layer of device data collection.","textIt":"Le informazioni sul dispositivo ora includono lo 'stato della chiamata', aggiungendo un nuovo livello di raccolta dati.","sentiment":"negative"},{"textEn":"The overall scope of personal data collected by Klarna has increased, impacting user privacy.","textIt":"L'ambito complessivo dei dati personali raccolti da Klarna è aumentato, influenzando la privacy degli utenti.","sentiment":"negative"},{"textEn":"User data protection rights under GDPR remain clearly outlined and accessible.","textIt":"I diritti di protezione dei dati degli utenti ai sensi del GDPR rimangono chiaramente delineati e accessibili.","sentiment":"positive"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Klarna faces increased responsibility for managing a broader scope of personal data, especially sensitive financial information. This requires robust data protection measures to ensure GDPR compliance.","complianceNoteEn":"GDPR Art. 24, 32"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"The expanded collection of financial and device data increases individual privacy risk under GDPR. Users should be aware of the new data points Klarna is gathering.","complianceNoteEn":"GDPR Art. 5, 6, 9"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"For Klarna, the expanded data collection necessitates a globally consistent and robust data governance framework. This includes managing diverse regulatory requirements and ensuring data security worldwide.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Globally, users face a higher privacy risk due to Klarna collecting more personal and sensitive data. This broadens the potential for data misuse or breaches across all regions.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Klarna's expanded data collection requires careful consideration of various US state privacy laws. Ensuring consistent compliance across different jurisdictions adds complexity and potential legal exposure.","complianceNoteEn":"State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Increased data collection, including financial and device 'call state', raises general privacy concerns for US users. While federal laws are limited, state laws like CCPA/CPRA offer some protections.","complianceNoteEn":"CCPA/CPRA"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Comprehensive"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Partial"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiContentModeration","label":"Content moderation","value":"Opaque"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Explicit Opt-In"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Mentioned"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Absent"}]}]},"humanReviewQuestions":["Does the original Privacy Notice source still match the recorded public snapshot version 5?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/71c0131c-38e2-4ac6-8a81-8adac2a16bc0","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"e0c816db8c3527fa21bbc5a374100ab3d0f9d423d73b6d9dcf9d2418f66b5462"}