Finland temporarily bans Yango taxi service from transferring passenger data to Russia

The Finnish Data Protection Authority (DPA) has banned Yandex and Ridetech International B.V. from processing and transferring to Russia personal data of customers collected by the Yango taxi service, writes The Office of the Data Protection Ombudsman of Finland.

The temporary order will come into effect on September 1 and will remain in force until November 30. The order is necessary due to a reform that will come into effect in Russia, which significantly weakens the protection of personal data when using taxi services.

“The Finnish DPA has become aware of a legislative reform that will enter into force in Russia at the beginning of September, under which the Federal Security Service of the Russian Federation will have the right to receive data processed in taxi operations. The information collected in the Yango taxi application may include, for example, a customer’s location information and the address of the taxi ride.”

The Finnish DPA believes that Yango will not be able to protect personal data as required by EU law, so a data suspension order is required.

The Yango taxi service operates in Finland and Norway. According to Yango, the taxi service’s personal data is processed by Ridetech International B.V. in the Netherlands, which is the service provider for the Yango app in the EU. According to Yango, the company also transfers personal data to Russia.

The DPAs of Finland and Norway cooperate closely with the Dutch DPA. The Finnish DPA’s decision was taken under an emergency procedure.

The decision of the Finnish DPA has been taken under an urgency procedure set out by the EU General Data Protection Regulation (GDPR), which allows actions to be taken exceptional circumstances. Under this procedure, supervisory authorities may immediately adopt provisional measures where necessary to protect the rights and freedoms of persons. Such measures may be valid for a maximum of three months. The order of the Finnish DPA concerns Yango’s operations in Finland.”

Yango may submit information to the Finnish DPA by September if it believes that this information may affect the assessment of the case. In addition, Yango must inform the Finnish DPA of the measures it takes on the basis of the order.

The Finnish DPA may also ask the European Data Protection Board (EDPB) to issue a binding cease-and-desist order to Yango if it does not intend to change its practices.

Earlier, the media reported that from September 1, the FSB will have round-the-clock access to the data of Yandex taxi service, including travel of passengers outside Russia. The service operates in more than 20 countries, including Finland, Norway, Israel and others.