The largest Q2 penalty: Yango-related data transfers to Russia

The Netherlands recorded the quarter’s largest individual case: a €100 million fine against MLU B.V., the European company behind the Yango taxi app. The Dutch Data Protection Authority found problems with the safeguards used for transferring personal data to Russia and ordered the company to stop transfers where GDPR requirements were not met.

The case illustrates why international data transfers require more than a formal contractual mechanism. Organisations must assess whether the destination country and the practical arrangements surrounding the transfer provide protections that are effectively equivalent to those required under EU data-protection law. The Dutch decision was specifically associated with inadequate guarantees for third-country transfers.

At approximately €100 million, the Yango-related penalty represented about 44% of the entire Q2 total. That concentration helps explain both the quarter’s surge and the importance of reviewing cross-border data flows as part of financial-risk management.

France, Italy and the UK also produced major penalties

Other significant cases reported for the quarter included:

• France: The telecom companies Free Mobile and Free received a combined €42 million in penalties, including a €27 million fine against Free Mobile. The cases involved shortcomings connected with subscriber-data security.
• Italy: Intesa Sanpaolo was fined €31.8 million over deficiencies in protecting customer banking data.
• United Kingdom: The Information Commissioner’s Office fined Reddit £14.47 million after finding that the company used children’s personal information unlawfully and failed to apply robust age-checking measures. Reddit appealed the monetary penalty notice.

The Reddit case shows that children’s privacy remains a high-risk enforcement area. Age assurance, lawful processing of children’s information and measures designed to reduce foreseeable harm can all become central to regulatory scrutiny.

Which GDPR failures are attracting the most attention?

The Q2 pattern was not limited to a single type of violation. The most prominent themes included:

Inadequate security controls

Security failures appeared in several of the major cases, including the French telecom penalties and the Italian banking decision. Organisations handling large volumes of customer information need controls that are appropriate to the sensitivity, scale and operational context of that processing.

Processing without a sufficient legal basis

Insufficient legal grounds for processing remain among the most frequent reasons for significant GDPR fines, according to the CMS GDPR Enforcement Tracker’s executive summary. Companies should be able to connect each material processing activity to a documented lawful basis and demonstrate that the basis matches what the organisation actually does.

Weak international-transfer safeguards

The Yango-related case places third-country transfers among the clearest high-value risks in the Q2 data. Transfer assessments should cover the actual flow of information, the entities receiving it, access by authorities in the destination country and the effectiveness of supplementary safeguards—not simply whether standard paperwork exists.

Children’s-privacy failures

The ICO’s Reddit decision reinforces the need for age-appropriate design, reliable age-assurance processes and a defensible approach to the lawful use of children’s personal data.

Media, finance and other data-intensive sectors face concentrated exposure

Media and finance companies accounted for six of the ten largest Q2 fines in Finbold’s reported breakdown. These sectors, along with technology, telecommunications and other consumer-facing industries, often process personal data at significant scale or use it in complex, highly interconnected systems.

The implication is not that every company in these sectors faces the same level of risk. Rather, the largest exposure tends to arise where organisations combine high data volumes with behavioural profiling, sensitive information, large user bases, cross-border infrastructure or complicated third-party arrangements.

What companies operating in Europe should prioritise

The Q2 enforcement pattern translates into five practical priorities:

1. Map processing activities and lawful bases. Keep a current record of what data is collected, why it is processed, who receives it and which legal basis supports each use.
2. Test security controls against real-world risk. Review access management, authentication, monitoring, retention, incident response and vendor controls—not just written policies.
3. Strengthen children’s-data protections. Make age assurance, consent, risk assessment and age-appropriate safeguards part of product and compliance reviews where children may access a service.
4. Reassess international transfers. Document transfer-risk assessments, verify the roles of each recipient and add supplementary safeguards where contractual terms alone are insufficient.
5. Escalate high-risk processing to senior leadership. The scale of the largest penalties makes privacy governance a financial and operational issue, not merely a legal checklist.

The main takeaway from Q2 2026

The reported €225.9 million Q2 total shows how quickly a single major decision can change the enforcement landscape. The Yango-related penalty accounted for nearly half of the quarter’s fines, while cases involving telecoms, finance and children’s privacy show that regulators are examining both core security practices and the legitimacy of how personal data is used.

For companies operating in Europe, the clearest lesson is to treat GDPR controls as part of enterprise risk management. Lawful processing, security, children’s protections and international data transfers should be tested continuously and supported by evidence that can withstand regulatory scrutiny.

The largest Q2 penalty: Yango-related data transfers to Russia

The Netherlands recorded the quarter’s largest individual case: a €100 million fine against MLU B.V., the European company behind the Yango taxi app. The Dutch Data Protection Authority found problems with the safeguards used for transferring personal data to Russia and ordered the company to stop transfers where GDPR requirements were not met.

The case illustrates why international data transfers require more than a formal contractual mechanism. Organisations must assess whether the destination country and the practical arrangements surrounding the transfer provide protections that are effectively equivalent to those required under EU data-protection law. The Dutch decision was specifically associated with inadequate guarantees for third-country transfers.

At approximately €100 million, the Yango-related penalty represented about 44% of the entire Q2 total. That concentration helps explain both the quarter’s surge and the importance of reviewing cross-border data flows as part of financial-risk management.

France, Italy and the UK also produced major penalties

Other significant cases reported for the quarter included:

• France: The telecom companies Free Mobile and Free received a combined €42 million in penalties, including a €27 million fine against Free Mobile. The cases involved shortcomings connected with subscriber-data security.
• Italy: Intesa Sanpaolo was fined €31.8 million over deficiencies in protecting customer banking data.
• United Kingdom: The Information Commissioner’s Office fined Reddit £14.47 million after finding that the company used children’s personal information unlawfully and failed to apply robust age-checking measures. Reddit appealed the monetary penalty notice.

The Reddit case shows that children’s privacy remains a high-risk enforcement area. Age assurance, lawful processing of children’s information and measures designed to reduce foreseeable harm can all become central to regulatory scrutiny.

Which GDPR failures are attracting the most attention?

The Q2 pattern was not limited to a single type of violation. The most prominent themes included:

Inadequate security controls

Security failures appeared in several of the major cases, including the French telecom penalties and the Italian banking decision. Organisations handling large volumes of customer information need controls that are appropriate to the sensitivity, scale and operational context of that processing.

Processing without a sufficient legal basis

Insufficient legal grounds for processing remain among the most frequent reasons for significant GDPR fines, according to the CMS GDPR Enforcement Tracker’s executive summary. Companies should be able to connect each material processing activity to a documented lawful basis and demonstrate that the basis matches what the organisation actually does.

Weak international-transfer safeguards

The Yango-related case places third-country transfers among the clearest high-value risks in the Q2 data. Transfer assessments should cover the actual flow of information, the entities receiving it, access by authorities in the destination country and the effectiveness of supplementary safeguards—not simply whether standard paperwork exists.

Children’s-privacy failures

The ICO’s Reddit decision reinforces the need for age-appropriate design, reliable age-assurance processes and a defensible approach to the lawful use of children’s personal data.

Media, finance and other data-intensive sectors face concentrated exposure

Media and finance companies accounted for six of the ten largest Q2 fines in Finbold’s reported breakdown. These sectors, along with technology, telecommunications and other consumer-facing industries, often process personal data at significant scale or use it in complex, highly interconnected systems.

The implication is not that every company in these sectors faces the same level of risk. Rather, the largest exposure tends to arise where organisations combine high data volumes with behavioural profiling, sensitive information, large user bases, cross-border infrastructure or complicated third-party arrangements.

What companies operating in Europe should prioritise

The Q2 enforcement pattern translates into five practical priorities:

1. Map processing activities and lawful bases. Keep a current record of what data is collected, why it is processed, who receives it and which legal basis supports each use.
2. Test security controls against real-world risk. Review access management, authentication, monitoring, retention, incident response and vendor controls—not just written policies.
3. Strengthen children’s-data protections. Make age assurance, consent, risk assessment and age-appropriate safeguards part of product and compliance reviews where children may access a service.
4. Reassess international transfers. Document transfer-risk assessments, verify the roles of each recipient and add supplementary safeguards where contractual terms alone are insufficient.
5. Escalate high-risk processing to senior leadership. The scale of the largest penalties makes privacy governance a financial and operational issue, not merely a legal checklist.

The main takeaway from Q2 2026

The reported €225.9 million Q2 total shows how quickly a single major decision can change the enforcement landscape. The Yango-related penalty accounted for nearly half of the quarter’s fines, while cases involving telecoms, finance and children’s privacy show that regulators are examining both core security practices and the legitimacy of how personal data is used.

For companies operating in Europe, the clearest lesson is to treat GDPR controls as part of enterprise risk management. Lawful processing, security, children’s protections and international data transfers should be tested continuously and supported by evidence that can withstand regulatory scrutiny.