European data protection authorities continue to cooperate on the supervision of Yango taxi service’s data transfers – Yango is allowed to continue operating in Finland until further notice
The Office of the Data Protection Ombudsman and the data protection authorities of the Netherlands and Norway have examined the operation of the Yango taxi service and agreed on the next steps in the matter. Based on new information, the Russian taxi legislation does not apply to Yango’s operations in Finland. The Data Protection Ombudsman has therefore revoked its decision to suspend data transfers to Russia, originally issued in August. The Data Protection Authorities will continue to cooperate on the supervision of the Yango taxi service's data transfers.
In August, the Data Protection Ombudsman issued an urgent interim order to Yandex LLC and Ridetech International B.V. to suspend the transfer of personal data collected by the Yango taxi service to Russia. The implementation of the order was postponed at the end of August for the assessment of further clarifications.
The interim order of the Data Protection Ombudsman was based on the entry into force of the new Russian taxi legislation. Based on information obtained by the Data Protection Ombudsman at that time, the legislation would have significantly extended the right of the Russian security service, the FSB, to obtain information processed in taxi operations, including Yango’s customers’ data in Finland. However, based on the information received later, the new Russian taxi legislation does not apply to taxi brokering activities in Finland. The Data Protection Ombudsman has therefore revoked the interim order.
The Dutch Data Protection Authority is leading the supervision of Yango taxi service’s processing of personal data
The Dutch Data Protection Authority is acting as the lead supervisory authority for the supervision of Yango taxi service’s processing of personal data. This is because Ridetech International B.V., which is responsible for the processing of personal data, has its head office in the Netherlands. The Office of the Data Protection Ombudsman and the Norwegian Data Protection Authority will continue to work closely with the Dutch Data Protection Authority and participate in the investigation of Yango cases. Within the European Economic Area, Yango taxi service operates in Finland and Norway.
The Data Protection Ombudsman does not have the power to intervene in Ridetech International B.V.’s activities in Finland other than for a fixed period. It is for the Dutch Data Protection Authority, as the lead supervisory authority, to take permanent decisions on the processing of Ridetech B.V.’s personal data.
Data Protection Ombudsman's decision (pdf, in Finnish)
More information:
Data Protection Ombudsman Anu Talus, anu.talus(at)om.fi, tel. 029 566 6766
Press releases of the Office of the Data Protection Ombudsman: