- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,621
The data of passengers and drivers found themselves where they should not be.
The passenger transportation service Yango, which is an international branch of Yandex.Taxi, was in the center of a large case of personal data. The Dutch Office for the Protection of Personal Data found that the information of passengers and drivers from Norway and Finland left for Russia without sufficient security guarantees.
A fine of 100 million euros has been awarded to MLU B.V., which manages the European version of Yango and is registered in the Netherlands. Through the application, residents of Norway and Finland order trips from the users connected to the service. According to the regulator, MLU transferred personal data to Russian companies, without providing the level of protection required by European rules.
The inspection began at the end of 2023. The Dutch regulator participated in the case because of the registration of MLU in the Netherlands, and the supervisory authorities of Norway and Finland joined, as it was about the data of residents of these countries.
The audit showed that Yango collected and stored on servers in Russia a large amount of information about customers and drivers from the above countries. Among the data were scans of driver's licenses, home addresses, contacts, bank account numbers, exact coordinates, travel history, photos, correspondence in chat rooms and social security numbers.
In the EU, the transfer of personal data outside Europe is regulated by the GDPR. Companies are allowed to send such information to other countries only at a comparable level of protection or in the presence of additional guarantees. According to the Dutch Office for the Protection of Personal Data, such a level was not provided in Russia, and government access to data could create risks for people.
The head of the regulator, Aleid Wolfsen, pointed out that sensitive information of passengers and drivers demanded particularly strict protection, including due to the lack of an independent privacy protection authority in Russia. The supervision concluded that the MLU did not comply with these requirements.
The MLU is obliged to immediately stop transmitting data from residents of Norway and Finland to Russia through the application Yango. The amount of the fine was calculated taking into account the turnover of the mother group Yandex. The company, however, can challenge this decision.
The passenger transportation service Yango, which is an international branch of Yandex.Taxi, was in the center of a large case of personal data. The Dutch Office for the Protection of Personal Data found that the information of passengers and drivers from Norway and Finland left for Russia without sufficient security guarantees.
A fine of 100 million euros has been awarded to MLU B.V., which manages the European version of Yango and is registered in the Netherlands. Through the application, residents of Norway and Finland order trips from the users connected to the service. According to the regulator, MLU transferred personal data to Russian companies, without providing the level of protection required by European rules.
The inspection began at the end of 2023. The Dutch regulator participated in the case because of the registration of MLU in the Netherlands, and the supervisory authorities of Norway and Finland joined, as it was about the data of residents of these countries.
The audit showed that Yango collected and stored on servers in Russia a large amount of information about customers and drivers from the above countries. Among the data were scans of driver's licenses, home addresses, contacts, bank account numbers, exact coordinates, travel history, photos, correspondence in chat rooms and social security numbers.
In the EU, the transfer of personal data outside Europe is regulated by the GDPR. Companies are allowed to send such information to other countries only at a comparable level of protection or in the presence of additional guarantees. According to the Dutch Office for the Protection of Personal Data, such a level was not provided in Russia, and government access to data could create risks for people.
The head of the regulator, Aleid Wolfsen, pointed out that sensitive information of passengers and drivers demanded particularly strict protection, including due to the lack of an independent privacy protection authority in Russia. The supervision concluded that the MLU did not comply with these requirements.
The MLU is obliged to immediately stop transmitting data from residents of Norway and Finland to Russia through the application Yango. The amount of the fine was calculated taking into account the turnover of the mother group Yandex. The company, however, can challenge this decision.
