Data protection authorities continue investigating the Yango taxi service's data transfers
The Office of the Data Protection Ombudsman and the data protection authorities of the Netherlands and Norway have investigated the operations of the Yango taxi service in the European Economic Area. The report received by the data protection authorities suggests that the taxi legislation entering into force at the beginning of September in Russia will not be applied to Yango's operations in the EEA. The Data Protection Ombudsman will analyse the report's impact on further processing of the matter.
On 4 August, the Data Protection Ombudsman issued an interim order to Yandex LLC and Ridetech International B.V. to suspend the transfer of personal data collected through the Yango taxi service to Russia and to cease processing the collected personal data as of 1 September. The Data Protection Ombudsman is postponing the enforcement of the interim order to 26 September for further investigation of the matter. The order to suspend the transfer of personal data will therefore not come into effect until September 27.
The Data Protection Ombudsman's decision to suspend data transfers, made on 4 August, was issued through the urgency procedure, because the Data Protection Ombudsman had been informed of an amendment to Russian legislation that would, in the Data Protection Ombudsman's assessment, significantly expand the Russian security service FSB's right to obtain data processed in taxi operations. Based on the information obtained at that time, the Data Protection Ombudsman considered it probable that the legislation would also apply to Yango's customers in Finland.
Due to information that has come to light since then, the data protection authorities have concluded that further investigation of the actual application of Russia's taxi legislation to the operations of the Yango taxi service is required. Even if the new taxi legislation will not be applied to Yango's operations, the Office of the Data Protection Ombudsman will continue investigating the taxi service's data transfers in active cooperation with the Dutch and Norwegian data protection authorities. The companies' report on their planned and implemented changes to the processing of personal data will also be evaluated as part of the investigation.
Data protection authorities looking into the overall lawfulness of Yango's transfers of personal data
The Finnish, Dutch and Norwegian data protection authorities have been investigating the lawfulness of Yango's data transfers even before the initiation of the urgency procedure by the Data Protection Ombudsman. The authorities' investigations have revealed that personal data collected by the Yango taxi service has been transferred to Russia.
It is possible that the FSB has access to data transferred to Russia regardless of the scope of taxi legislation, but the investigation is still ongoing. At present, the data protection authorities' principal line of investigation concerns the lawfulness of Yango's personal data transfers as a whole.
The Data Protection Ombudsman does not have the power to ban the operations of the Yango taxi service in Finland, but only to take temporary measures to address its processing of personal data. According to the company, the Dutch-based company Ridetech International B.V. is responsible for the taxi service's personal data processing, which would mean that a permanent decision could only be made by the Dutch data protection authority or the European Data Protection Board.
Data Protection Ombudsman’s decision on Finlex (in Finnish)
Further information:
Deputy Data Protection Ombudsman Heljä-Tuulia Pihamaa
Please address interview requests to the Office of the Data Protection Ombudsman's communications department:
Communications Specialist Elina Autio, elina.autio(at)om.fi or viestinta.tietosuoja(at)om.fi, tel. +358 29 566 6705
From 4 September:
Deputy Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. +358 29 566 6766
The Office of the Data Protection Ombudsman's release: Finnish DPA bans Yango taxi service transfers of personal data from Finland to Russia temporarily (8 August 2023)