Cybersecurity Policy Report, Taxi App Fined in Europe Over Data Transfers to Russia, (May 12, 2026)

By Tony Foley

Following an investigation under the cooperation procedures provided by the European Union’s General Data Protection Regulation (GDPR) one-stop-shop enforcement mechanism, data protection authorities from three EU privacy regulators have imposed a 100 million euro ($117.3 million) penalty on MLU B.V., the company responsible for the processing of data collected by the Yango taxi application in Europe, for the transfer of app users’ data to Russia without adequate safeguards.

The Dutch DPA, Autoriteit Persoonsgegevens (AP), acted as the lead supervisory authority for the investigation into MLU because the company is headquartered in the Netherlands. AP was joined in the investigation by Finland’s Office of the Data Protection Ombudsman and Norway’s Datatilsynet as concerned supervisory authorities, according to a press release from the Finnish agency. The investigation began in 2023 and focused on whether the data of users of the Yango app, which operates in Finland and Norway, was transferred to Russia and whether it was appropriately protected.

The agencies concluded that the users’ data was in fact transferred to Russia, that the company failed to demonstrate that the Russian authorities’ access to the data was blocked with sufficient efficiency, and that the level of data protection in Russia does not correspond to the level of protection of personal data in the EU, given the extensive right of access to personal data by Russian intelligence authorities. According to the release, the decision marks the first decision by EU DPAs regarding the assessment of data transfers to Russia.

"Companies operating in the EU must ensure a high level of protection of personal data by complying with EU data protection rules,” said Finnish Data Protection Ombudsman Anu Talus. “It is not allowed to transfer personal data outside the EU if its security cannot be ensured."

The decision orders MLU to stop transferring the personal data of EU Yango users to Russia. The company maintained that Yango’s operations in Finland and Norway ceased in October 2025, but the decision pointed out that the Yango app was still available in Finnish and Norwegian app stores. MLU may still object to the penalty.

News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR