Personal Data Protection Service Initiates Probe into Yandex.Go App’s Data Processing

On August 9, the Personal Data Protection Service of Georgia launched an investigation into the legality of the processing of personal data through the Yandex.Go application. The Service itself disseminated this information, emphasizing the high public interest in the matter and promising to quickly communicate the results of the investigation.

Additionally, the Service noted: “Before downloading any application, it is important that citizens familiarize themselves with the details of what data the application will access on their device, and only then download it”.

Several days prior to the launch of the investigation the independent Russian-language publication Meduza, reported that Russia’s Federal Security Service (“FSB”) would gain unrestricted access to Yandex’s database, in particular for the Yandex.Go taxi ordering service. According to Meduza, the FSB is in the process of gaining continuous, round-the-clock access to Yandex’s data, which will extend beyond Russia’s borders and potentially affect residents of more than 20 countries where Yandex still operates, including Armenia, Georgia, Norway, Kazakhstan, Israel and Finland (notably, Latvia and Estonia have blocked the activities of Yandex in 2022).

The law was adopted at the third hearing on December 22, 2022 in the Russian Duma. In particular, the law introduces the obligation of a passenger taxi ordering service to provide the FSB with automated remote access to information systems and database used for receiving, storing, processing and transmitting orders. The FSB should have unrestricted access to the personal data too, as confirmed by the law signed by Prime Minister Mikhail Mishustin, which enters in force on September 1. Among Russian taxi services, only Yandex Go has been included in this information exchange register.

Notably, on August 8, the Finnish Data Protection Authority directed Yandex LLC and Ridetech International B.V. to halt the transfer of customers’ personal data from the Yango taxi service to Russia and to cease processing the collected personal data. This temporary order will be effective starting September 1 and is expected to last until November 30.

The revelation of FSB’s potential data access raised concerns among Yandex Go customers abroad, prompting inquiries to the company’s support service. A source within Yandex told Meduza that the aforementioned concerns prompted employees to seek clarity on data protection from their management. In response, a management representative stated that Yandex Go and Yango data remain within Russian borders. They also urged employees to avoid discussing the geographic location of the data centers in customer interactions.

The same source said all databases of Yango services have been geographically consolidated within Russia, with no distinction between international and domestic segments. Meanwhile, Yandex claims that in spite of that the access to travel data would remain the prerogative of law enforcement in the country where the trip took place, in accordance with local laws. The company promised that this operational logic would continue even after September 1, when the new law enters into force.

This post is also available in: ქართული (Georgian) Русский (Russian)