Users contradict them on the statement that no bank details were visible. [0] Although Esra (the user whose tweet is linked from the original thread on this to

Users contradict them on the statement that no bank details were visible. [0] Although Esra (the user whose tweet is linked from the original thread on this topic on HN) gets it wrong in saying that Klarna pretends this wasn't a data breach in the sense of the GDPR.[1] They don't say that, they only say it wasn't sensitive pii in the sense of the GDPR. This is technically true [1], but seems misleading. Actually 'sensitive' pii in the sense of the GDPR is never submitted to Klarna in the first place. Also, it's unclear how they count the number of affected users. It would have to be those whose details were shown to other users accidentally for it to make sense, not the number of users who saw other people's information. [0] https://twitter.com/AskKlarna/status/1397912074630569985?s=20 https://twitter.com/AskKlarna/status/1397912074630569985?s=2... [1] https://ec.europa.eu/info/law/law-topic/data-protection/reform/rules-business-and-organisations/legal-grounds-processing-data/sensitive-data/what-personal-data-considered-sensitive_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...