Skip to main content
Praxikon

Enforcement

100 million euro fine for MLU B.V. (Yango) for transfers to Russia

Date
Status
status not established
Body
Autoriteit Persoonsgegevens
Reference
AP-kenmerk 2025-005323 (besluit van 1 april 2026, gepubliceerd 8 mei 2026)
Amount
€100,000,000

What it is about

The Dutch DPA fined MLU B.V. 100 million euros. MLU is the legal successor of the dissolved Ridetech International B.V., the company behind the European Yango app. Personal data of drivers and customers in Norway and Finland went to Yandex.Taxi LLC and Yandex LLC in Russia. This included driving licence details, contact details and location data. Ridetech did not demonstrate that appropriate safeguards were in place. According to the DPA this breaches Articles 44 and 46 GDPR, read with Article 5(1)(a) and 5(2) GDPR. The infringement began on 23 May 2022 and was still ongoing when the decision was taken. The DPA also imposed a processing ban with immediate effect: the transfers to Russia must stop. The investigation was carried out jointly with the Norwegian and Finnish supervisory authorities.

What this means in practice

Transferring data to a country without an adequacy decision? Then you must be able to prove that you use a valid transfer tool. You must also be able to show that the data is equally well protected in practice. Pseudonymisation and encryption do not replace that when the recipient within the group holds the keys or has access. A legal successor remains liable for the breaches of a dissolved company. The fine can be calculated on the worldwide turnover of the whole group.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, besluit boete Yangochecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law8 of 11

Guidelines8 of 10

Enforcement and fines8 of 10

Legislation in motion