Dutch watchdog fines taxi app Yango €100 million over alleged data transfers to Russia

The Dutch Data Protection Authority (AP) has imposed a 100 million euros fine on the Netherlands-based company behind the taxi app Yango. That company, MLU, allegedly shared personal data of Yango users in Norway and Finland with Russia without adequate security measures in place, according to the authority. MLU, a Netherlands-based subsidiary of Russian tech firm Yandex, denied the charge.

“In Russia, personal data is not as well protected as in Europe. This means the Russian government could potentially access this data,” said AP chair Aleid Wolfsen. “That is why sensitive data from both customers and drivers should have been better protected, especially given the absence of an independent privacy regulator in Russia. We found that this was not done properly, and that is serious.”

The size of the penalty reflects the annual revenue of MLU parent Yandex, which exceeded 12 billion euros in 2024. MLU still has the option to challenge the decision by filing an objection or appeal.

The Dutch Data Protection Authority has been investigating the case together with Norwegian and Finnish privacy regulators since late 2023. They concluded that Yango stored sensitive information from both passengers and drivers, including driving license scans, home addresses, and precise location data, on servers located in Russia. Under European rules, personal data may only be transferred outside the EU if it receives an equivalent level of protection.

Yango is available in more than 30 countries worldwide. In Europe, according to its website, these include Norway, Finland, Serbia, and Moldova.

MLU has announced it will challenge the fine. “The personal data was stored exclusively within the EU in pseudonymised and encrypted form, making it technically inaccessible to third parties. We applied all appropriate safeguards in line with European privacy legislation,” the parent company said in a written response, adding that Yango has not been active in Norway and Finland since last year. The company also says it fully cooperated with the Dutch Data Protection Authority’s investigation.

Yandex has been accused of colluding with authorities in Russia to develop intelligence that Russia could use against Ukraine, and to stifle opposition politicians domestically, including Alexei Navalny. Founder Arkady Volozh landed on European Union sanctions lists until the Dutch entity Yandex N.V. was broken up, with Russian assets sold off, and Volozh resigning as CEO.

But the billionaire stayed on as head of the business units in the Netherlands, which were reorganized into a new Dutch company, Nebius. That business also owns subsidiary Toloka.

The latter was alleged by investigative reporters to have helped develop facial recognition software used by Russia to identify and pursue protestors in that country. Still, Toloka garnered the interest of Amazon founder Jeff Bezos for its artificial intelligence models trained by humans.

His investment vehicle, Bezos Expeditions, led an investment round equal to 72 million dollars for the firm. The next year, U.S. tech giant Meta signed a 27 billion dollar deal with Nebius, with the Dutch company contracted to provide AI infrastructure.

Both Nebius and Toloka are based in Amsterdam. Volozh also owns a multimillion euro residential property near the capital's Vondelpark, which was squatted for about two years.