Finnish Data Protection Ombudsman Fines Yandex’s Dutch Subsidiary €100 Million for Transferring Yango User Data to Russia
Finland’s Data Protection Ombudsman announced on May 11 that MLU B.V., a Dutch‑registered subsidiary of Russian tech giant Yandex, has been fined €100 million for illegally transferring personal data of Yango taxi‑service users to Russia. The penalty, the largest ever imposed by the Finnish authority, follows an investigation that found the company breached EU data‑privacy rules by moving location data, phone numbers, and payment information across borders without adequate safeguards.
The case underscores growing scrutiny of Russian digital firms operating in Europe after the EU’s tightened data‑transfer regulations, such as the GDPR and the recent “Digital Services Act.” In previous years, Yandex faced fines in other EU states for similar practices, prompting a broader debate over the security implications of Russian‑controlled data flows.
The Ombudsman’s decision, posted on the agency’s website, cited a “systematic violation” and noted that the data was stored on servers in the Russian Federation, where Russian authorities could potentially access it. Yandex’s spokesperson, quoted by Meduza, called the fine “disproportionate” and said the company would appeal the ruling, asserting that the data transfers complied with “relevant legal frameworks.” Reuters, covering the story, reported that the €100 million fine represents roughly 0.5 % of Yandex’s annual revenue, and that the company could face additional sanctions from other EU regulators.
Data‑privacy advocates hailed the decision as a decisive step toward protecting European citizens from foreign surveillance. Dr. Petra Laine, senior researcher at the Finnish Institute for Security and Technology, warned that “without strong enforcement, companies can continue to treat personal data as a commodity.” Conversely, some market analysts cautioned that the fine could strain Yandex’s expansion plans in the Nordic region, potentially prompting the firm to restructure its data‑handling practices.
The next phases will involve Yandex’s appeal process, slated for a hearing in the Finnish Administrative Court in July, and possible coordination with the European Data Protection Board to align enforcement across the bloc. Stakeholders will also watch for reactions from Russian regulators, who have previously defended cross‑border data sharing as a “norm of digital cooperation.”