Beginning on September 1, the travel details of Israelis using the Yango ride-hailing service may come under the purview of Russian security services, as revealed by Meduza – a liberal media outlet associated with the opposition in Russia and currently operating from Latvia after being labeled an "undesirable organization."
Read more:
Sources within the parent company Yandex, which is not officially a Russian company but still maintains significant ties with the country and has a substantial presence there, conveyed to Meduza that, according to their management, all information regarding rides in all the countries where Yango operates will be stored together.
The absence of separation between countries will become problematic on September 1, when a new law regulating ride-hailing activity in Russia comes into effect. Under this law, the domestic security service of Russia, the FSB, will have the authority to access travel data from all ride-hailing providers. Meduza's report is based, among other things, on an internal email where service employees based outside of Russia attempted to clarify with their management how user information is retained. They were informed that it is stored in Russia and were requested not to disclose the server locations if questioned about it.
The terms of service of Yandex allow the company to transfer information to Russia and store it there, with its processing technically done through an Israeli entity. What kind of information are we talking about? The two main types are the data provided by the users themselves, whether about themselves or their rides, and also technical information collected from the ordered device.
The company does state in its privacy policy for users in the European Union, Switzerland and Israel that Yandex "takes appropriate measures to ensure that personal data is processed in accordance with the privacy protection laws of the European Union." However, if the information is indeed stored on servers within Russia, it's not clear how the company can do so while adhering to Russian law, which requires personal data to be retained for at least six months.
In response, Yandex Israel said in a statement: "Russian regulation has no influence or capacity to impact the international operations of Yandex as a whole, including Yandex Israel, which is an Israeli company bound by Israeli laws. Yandex Israel operates according to the highest privacy and security standards in the world, following the General Data Protection Regulation (GDPR) protocol and even surpassing Israeli standards. There is no information about customers being transferred to Russian authorities currently, and there will be no such transfer in the future."