Klarna's Written Statement on App Bug

klarna.com

2 points·tcmb··4 comments

Whatever you think about the engineering environment that allowed this type of error, you still have to acknowledge that this type of speedy communication is exemplary.

I wouldn't call it exemplary, I mean they have to say _something_, and it clearly was an error on their side, so they're only admitting what they cannot avoid to admit.

See my other comment on the hair splitting regarding sensitive information. And we have to see whether it's true that no bank account information was visible.

Hm... I guess lots of times I feel like it takes too long for a statement like this to come out, and when it comes out it equivocates more than this one. But I would agree with you that this _should_ be par for the course.

Users contradict them on the statement that no bank details were visible. [0]

Although Esra (the user whose tweet is linked from the original thread on this topic on HN) gets it wrong in saying that Klarna pretends this wasn't a data breach in the sense of the GDPR.[1] They don't say that, they only say it wasn't sensitive pii in the sense of the GDPR.

This is technically true [1], but seems misleading. Actually 'sensitive' pii in the sense of the GDPR is never submitted to Klarna in the first place.

Also, it's unclear how they count the number of affected users. It would have to be those whose details were shown to other users accidentally for it to make sense, not the number of users who saw other people's information.

[0] https://twitter.com/AskKlarna/status/1397912074630569985?s=2... [1] https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Reply on news.ycombinator.com