{"schema":"https://policywatcher.online/schemas/evidence-packet/v1","schemaVersion":"1.0.0","mappingVersion":"2026-07-29.1","changeId":"e5b60963-4f7d-4396-97b2-b0a1f263fc80","screeningDate":"2026-07-10T01:48:59.366Z","publicationGate":"published","company":{"id":"fc0a9a77-eb4b-432a-8229-00185c53d30e","name":"Klarna","slug":"klarna","industry":"FinTech"},"policy":{"id":"0fed73f4-ac93-4699-9d66-dd65ab6780cc","name":"Privacy Notice","type":"privacy","jurisdiction":"EU","sourceUrl":"https://www.klarna.com/ie/privacy/"},"sourceConfidence":{"state":"verified-retrieval","lastCheckedAt":"2026-08-21T19:01:53.224Z","retrievalChannel":"direct","dataStatus":"Available","publicSnapshotEvidence":true,"limitation":"Source confidence describes recorded retrieval and publication state. It does not rate the provider policy or certify source authenticity."},"snapshots":{"old":{"version":1,"sha256":"2f199bc90e5388701a95a88377a51b3df53c644f22dd0882330c14d8bbbfc1ab","capturedAt":"2026-07-06T09:44:06.384Z"},"current":{"version":2,"sha256":"51d50308f4dbd2a60fb7573d32bd423807cb6ccd31141c7c1b7d3f58a07ef0c7","capturedAt":"2026-07-10T01:48:59.363Z"}},"assessment":{"summary":"No changes were detected in Klarna's Privacy Notice, maintaining existing data collection, security practices, and user rights for financial services.","overallRisk":"Medium","overallScore":5,"previousPublicChange":null,"scoreDelta":null,"direction":"baseline","reasons":[{"icon":"warning","textEn":"Extensive data collection for financial services increases inherent risk.","textIt":"L'ampia raccolta dati per servizi finanziari aumenta il rischio intrinseco.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"warning","textEn":"AI assistant use mentioned without clear details on data training or opt-out.","textIt":"Uso dell'assistente AI menzionato senza dettagli chiari su addestramento dati o opt-out.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"},{"icon":"info","textEn":"User rights for data access and deletion are clearly outlined, though with legal limits.","textIt":"I diritti utente per accesso e cancellazione dati sono chiari, seppur con limiti legali.","deltaScore":0,"evidenceQuote":null,"evidenceSide":null,"relatedKpi":null,"anchorStatus":"not-recorded"}],"keyPoints":[{"textEn":"Extensive data collection for credit checks, fraud prevention, and personalized services.","textIt":"Ampia raccolta dati per controlli di credito, prevenzione frodi e servizi personalizzati.","sentiment":"negative"},{"textEn":"Strong commitment to data security with encryption, limited access, and external audits.","textIt":"Forte impegno per la sicurezza dei dati con crittografia, accesso limitato e audit esterni.","sentiment":"positive"},{"textEn":"Users can access and request deletion of data, with legal retention exceptions for financial data.","textIt":"Gli utenti possono accedere e richiedere la cancellazione dei dati, con eccezioni legali per i dati finanziari.","sentiment":"neutral"},{"textEn":"AI assistant used for customer support, but data usage for AI training is not specified.","textIt":"Assistente AI utilizzato per il supporto clienti, ma l'uso dei dati per l'addestramento AI non è specificato.","sentiment":"negative"}],"regionImpacts":[{"region":"EU","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Klarna's status as a financial institution implies adherence to strict EU financial regulations and data security standards. Compliance with GDPR and upcoming AI Act requirements for AI systems will be crucial.","complianceNoteEn":"GDPR, DORA (Digital Operational Resilience Act)"},{"region":"EU","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users retain GDPR rights (access, deletion), but legal obligations for financial data retention may limit full deletion. The use of AI assistants without clear data training policies could raise concerns under future AI Act provisions.","complianceNoteEn":"GDPR Art. 17 (Right to erasure)"},{"region":"Global","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Maintaining robust security and compliance with diverse international data protection frameworks is essential for global operations. The lack of explicit cross-border transfer details could pose challenges.","complianceNoteEn":null},{"region":"Global","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"General principles of data security and user control are applied, but specific rights vary by local jurisdiction. Users should review local laws for full understanding of their data rights.","complianceNoteEn":null},{"region":"US","perspective":"Enterprise","riskLevel":"Medium","impactAnalysisEn":"Compliance with US financial regulations (e.g., GLBA) and state-specific privacy laws is crucial for data handling. Managing data across various state privacy frameworks adds complexity.","complianceNoteEn":"GLBA, State Privacy Laws"},{"region":"US","perspective":"Individual","riskLevel":"Medium","impactAnalysisEn":"Users have rights similar to CCPA/CPRA for data access and deletion, but financial data is often subject to other laws like GLBA. Transparency around AI data usage is less regulated than in the EU.","complianceNoteEn":"CCPA/CPRA, GLBA (Gramm-Leach-Bliley Act)"}],"explanationBoundary":"Score reasons and deltaScore values are stored AI-assisted screening outputs. Verified anchors confirm only that the quoted passage occurs in the named snapshot; they do not prove the interpretation."},"governance":{"boundary":"Mappings identify review relevance between recorded PolicyWatcher KPI fields and framework topics. They are not legal interpretations, conformity assessments, certifications or compliance verdicts.","mappings":[{"framework":{"id":"eu-ai-act","name":"Regulation (EU) 2024/1689 (EU AI Act)","shortName":"EU AI Act","referenceUrl":"https://eur-lex.europa.eu/eli/reg/2024/1689/oj","referenceVersion":"Official Journal text, 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, automated decisions, data use and human oversight review?","kpiFields":["kpiAiTrainingOptOut","kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAiTrainingOptOut","label":"AI training opt-out","value":"Not Available"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"iso-42001","name":"ISO/IEC 42001:2023","shortName":"ISO/IEC 42001","referenceUrl":"https://www.iso.org/standard/42001","referenceVersion":"ISO/IEC 42001:2023 overview","reviewQuestion":"Which recorded policy statements may inform an AI management-system review of transparency, risk oversight and independent assurance?","kpiFields":["kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit","kpiRegulatoryCompliance"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"},{"field":"kpiRegulatoryCompliance","label":"Regulatory compliance","value":"Partial"}]},{"framework":{"id":"nist-ai-rmf","name":"NIST AI Risk Management Framework 1.0","shortName":"NIST AI RMF","referenceUrl":"https://www.nist.gov/itl/ai-risk-management-framework","referenceVersion":"AI RMF 1.0; NIST revision in progress, checked 2026-07-29","reviewQuestion":"Which recorded policy statements may support Govern, Map, Measure or Manage review questions?","kpiFields":["kpiAlgoTransparency","kpiAutomatedDecision","kpiAiBiasFairness","kpiContentModeration"]},"status":"mapped","assessedCount":3,"mappedFieldCount":4,"evidence":[{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAutomatedDecision","label":"Automated decisions","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"}]},{"framework":{"id":"oecd-ai-principles","name":"OECD AI Principles","shortName":"OECD AI Principles","referenceUrl":"https://oecd.ai/en/ai-principles","referenceVersion":"OECD AI Principles, updated 2024","reviewQuestion":"Which recorded policy statements may be relevant to transparency, fairness, accountability and user agency review?","kpiFields":["kpiConsentMechanism","kpiAlgoTransparency","kpiAiBiasFairness","kpiIndependentAudit"]},"status":"mapped","assessedCount":4,"mappedFieldCount":4,"evidence":[{"field":"kpiConsentMechanism","label":"Consent mechanism","value":"Implicit"},{"field":"kpiAlgoTransparency","label":"Algorithmic transparency","value":"Opaque"},{"field":"kpiAiBiasFairness","label":"AI bias and fairness","value":"Absent"},{"field":"kpiIndependentAudit","label":"Independent audit","value":"Mentioned"}]}]},"humanReviewQuestions":["Does the original Privacy Notice source still match the recorded public snapshot version 2?","Do the cited source passages support each displayed reason, KPI value and regional note?","Which advisory framework topics require specialist legal, risk or governance review for this use case?","Has a later public change superseded this packet before it is reused in a decision or publication?"],"methodologyUrl":"https://policywatcher.online/methodology/confidence","changeUrl":"https://policywatcher.online/change/e5b60963-4f7d-4396-97b2-b0a1f263fc80","boundary":"This packet records PolicyWatcher evidence and AI-assisted screening for one public change. It is not legal advice, a compliance verdict, a certification, or proof that the external source remains unchanged.","contentDigest":"99cf8bfefb690384683fe8bd8d5b24c84455c75aa64be8cc1c330d1ec9d3476a"}