On August 8, 2023, the Office of the Data Protection Ombudsman (Ombudsman) announced that it had issued an order to Yandex LLC and Ridetech International B.V. to suspend the transfer of any customers' personal data that is collected in the Yango taxi service to Russia and to stop processing the collected personal data, starting from September 1, until November 30, 2023.

Background to the decision

In particular, the Ombudsman noted that it had become aware of a legislative reform that will enter into force in Russia at the beginning of September, under which the Federal Security Service of the Russian Federation (FSB) will have the right to receive data processed in taxi operations. Additionally, the Ombudsman explained that the Yango taxi service is processed by Ridetech International in the Netherlands, a service provider of Yango in the EU, and that the company is transferring personal data to Russia. Information collected in the Yango taxi app may include, for example, a customer's location information and the address of the taxi ride.

Findings of the Ombudsman

The Ombudsman considered that the legislative reform that will enter into force in Russia will significantly weaken the protection of customers' personal data when using the Yango taxi service and that it is not possible for the respondent companies to protect personal data as required by EU legislation, in light of the abovementioned legislative reform in Russia.

Notably, on August 7, 2023, the Norwegian data protection authority (Datatilsynet) issued a decision in which it issued an advance notification to the same respondent companies regarding its intention to stop any transfers of personal data to Russia, in relation to the Yango app, from September 1, 2023, for violations of the General Data Protection Regulation (GDPR).

Outcomes

Consequently, the Ombudsman imposed the aforementioned order on the respondent companies, which concerns Yango's operations in Finland. The respondent companies may submit information to the Ombudsman before September 2023.

You can read the press release here.

Update: September 27, 2023

Ombudsman lifts ban imposed on Yango

On September 26, 2023, the Ombudsman announced its decision 7732/161/23, issued on September 25, 2023, in which it lifted the aforementioned order to Yandex and Ridetech International. In particular, the Ombudsman noted that, based on its investigations, relevant Russian legislation does not apply to Yango's operations in Finland, which justified the removal of the ban. 

You can read the press release here and the decision here, both only available in Finnish.