Netherlands-based cab app secretly transmitted customer data to Russia

©Paul Hanaoka via Unsplash

MLU, the company behind the Netherlands-based cab app Yango, has been fined as much as 100 million euros by the Personal Data Authority for forwarding sensitive personal data of drivers and customers to Russia.

AP conducted a joint investigation with the Norwegian and Finnish privacy regulators and concluded that MLU was indeed heavily at fault. MLU has its European headquarters in the Netherlands.

Yango is part of the international arm of Russian technology company Yandex. It operates in dozens of countries in Europe, Africa and the Middle East. In Norway and Finland, users can use the app to book cab rides with connected drivers. In doing so, the app collects a large amount of data, including scans of driver's licenses, residential addresses, account numbers, precise locations, trip data, photos, chat conversations and social security numbers. That data was stored on servers in Russia. And that is precisely where the problem lies.

According to AP chairman Aleid Wolfsen, the fact that data is sent to Russia is problematic. In Russia, personal data is less well protected than in Europe, he said. As a result, the Russian government could potentially gain access to that information. Sensitive customer and driver data should therefore have been extra well protected, especially since Russia does not have an independent privacy regulator. There were fears that the data was being passed on to the FSB, Russia's federal security service and successor to the KGB.

As the lead regulator, the Personal Data Authority has now ordered MLU to immediately stop transferring personal data of Norwegian and Finnish users to Russia. It was also fined 100 million euros. That amount is based on the turnover of parent company Yandex. However, the company can still appeal the decision.

©Paul Hanaoka via Unsplash - illustration image