3 ms·

There is a broader issue with web sites that incorporate external content that I haven't yet seen addressed. The moment you load a resource on your page from a

There is a broader issue with web sites that incorporate external content that I haven't yet seen addressed. The moment you load a resource on your page from an external source, you lose almost all control of what the operator of that external source does with any personal data that your visitor's browser sends to them, any cookies it sends with its reply, or what it does more generally in the case of executable resources. Given that modern web sites routinely incorporate external assets for a multitude of reasons, has anyone ever found any official, authoritative guidance on who is the data controller or data processor in such cases, how they are expected to meet any obligations they have in terms of transparency and obtaining consent, or the related question of who is responsible for giving notifications or obtaining consent if required under the "cookie law"?

Kliment 8y ago
The way I understand it it's extremely simple. Say you have a site. You are the contact point with the data subject, and therefore you are the controller. Anyone you subcontract spying on your users to is a data processor acting on your behalf, and therefore you are responsible for their behavior. You should have agreements in place with all your external resource providers that touch personal data. If any personal data leaks to them, you are responsible for notifying users of this and obtaining their consent if required. In most cases for external assets where no personal data is expected to flow to the asset provider (say loading fonts from a CDN) it's sufficient for the asset provider to give you their assurance that they don't collect or store data from visitors you send their way. If you have an adverterrorist-operated spyware embed like most ad networks on your site, then it's your responsibility to ensure that the adverterrorists are handling the data in a compliant way, and you need to notify your users of your relationship and obtain their consent to pass their data to a third party. Just because you are using a third party to do the spying does not remove your responsibility.
- Silhouette 8y ago
  Say you have a site. You are the contact point with the data subject, and therefore you are the controller. But that's not what how the controller is defined in the regulations. To be the controller, you must be "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". If you don't even have any way to know what personal data a third party is collecting or how it's being used, and you're linking to content that is freely available but over which you have no control, you're not even close to fitting that definition. You should have agreements in place with all your external resource providers that touch personal data. But that fundamentally breaks most of the modern WWW, which is not a reasonable thing to do. You can't even have a personal blog linking to a jQuery CDN to expand or contract your sidebar or Google Fonts to make things look pretty at that point. Just because you are using a third party to do the spying does not remove your responsibility. If they're spying at your request and on your behalf, that's one thing. But it is inherent in the technologies of the web that third parties may be doing all kinds of things without your knowledge, consent or control. Moreover, even if you have somehow satisfied yourself that there is nothing inappropriate going on when you first incorporate external content in your page by reference, there is in general no technical mechanism to guarantee that the situation will not change later. In some limited cases tools like subresource integrity can help, but they only address specific parts of the general issue.
jdietrich 8y ago
GDPR is explicitly agnostic to technical details (recital 15). The why is at least as important as the what. See the definition of controller in Article 4: "‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data" If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f). As long as you've performed a reasonable risk assessment about this activity and have records to prove it, you should satisfy your obligations as a controller under Chapter 4. If they go rogue and add a bunch of tracking scripts to the library, they're liable. You'd still need to notify about the breach. If you're embedding a Javascript ad unit that does a bunch of tracking, you probably don't have a legitimate interest under Art. 6(1)(f), so you'll need consent. You're intentionally passing a bunch of personal data to a third party, so your responsibilities with regards to risk assessment are far greater. You and the ad provider probably constitute joint controllers under Art. 26. https://gdpr-info.eu/recitals/no-15/ https://gdpr-info.eu/recitals/no-15/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/chapter-4/ https://gdpr-info.eu/chapter-4/ https://gdpr-info.eu/art-26-gdpr/ https://gdpr-info.eu/art-26-gdpr/ IANAL etc.
- Silhouette 8y ago
  If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f). But if you're embedding a JS library from a CDN, then as a matter of fact, you aren't passing any data about your user to the third party at all. The user's browser is doing that as part of its normal operation. Moreover, as another matter of fact, you cannot have either any knowledge or any control over what happens next regarding any personal data the third party is collecting or how it is being processed, unless you have some separate arrangement with the third party that goes well beyond mere linking or embedding. Logically, it doesn't seem to make much sense for you to be either the controller or the processor in that instance. However, if the third party plays either role, they may have no mechanism to communicate with your site visitor to fulfil their obligations either.
  - 8y ago

Kliment 8y ago

The way I understand it it's extremely simple. Say you have a site. You are the contact point with the data subject, and therefore you are the controller. Anyone you subcontract spying on your users to is a data processor acting on your behalf, and therefore you are responsible for their behavior. You should have agreements in place with all your external resource providers that touch personal data. If any personal data leaks to them, you are responsible for notifying users of this and obtaining their consent if required. In most cases for external assets where no personal data is expected to flow to the asset provider (say loading fonts from a CDN) it's sufficient for the asset provider to give you their assurance that they don't collect or store data from visitors you send their way. If you have an adverterrorist-operated spyware embed like most ad networks on your site, then it's your responsibility to ensure that the adverterrorists are handling the data in a compliant way, and you need to notify your users of your relationship and obtain their consent to pass their data to a third party. Just because you are using a third party to do the spying does not remove your responsibility.

Silhouette 8y ago
Say you have a site. You are the contact point with the data subject, and therefore you are the controller. But that's not what how the controller is defined in the regulations. To be the controller, you must be "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". If you don't even have any way to know what personal data a third party is collecting or how it's being used, and you're linking to content that is freely available but over which you have no control, you're not even close to fitting that definition. You should have agreements in place with all your external resource providers that touch personal data. But that fundamentally breaks most of the modern WWW, which is not a reasonable thing to do. You can't even have a personal blog linking to a jQuery CDN to expand or contract your sidebar or Google Fonts to make things look pretty at that point. Just because you are using a third party to do the spying does not remove your responsibility. If they're spying at your request and on your behalf, that's one thing. But it is inherent in the technologies of the web that third parties may be doing all kinds of things without your knowledge, consent or control. Moreover, even if you have somehow satisfied yourself that there is nothing inappropriate going on when you first incorporate external content in your page by reference, there is in general no technical mechanism to guarantee that the situation will not change later. In some limited cases tools like subresource integrity can help, but they only address specific parts of the general issue.

jdietrich 8y ago

GDPR is explicitly agnostic to technical details (recital 15). The why is at least as important as the what. See the definition of controller in Article 4: "‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data" If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f). As long as you've performed a reasonable risk assessment about this activity and have records to prove it, you should satisfy your obligations as a controller under Chapter 4. If they go rogue and add a bunch of tracking scripts to the library, they're liable. You'd still need to notify about the breach. If you're embedding a Javascript ad unit that does a bunch of tracking, you probably don't have a legitimate interest under Art. 6(1)(f), so you'll need consent. You're intentionally passing a bunch of personal data to a third party, so your responsibilities with regards to risk assessment are far greater. You and the ad provider probably constitute joint controllers under Art. 26. https://gdpr-info.eu/recitals/no-15/ https://gdpr-info.eu/recitals/no-15/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/chapter-4/ https://gdpr-info.eu/chapter-4/ https://gdpr-info.eu/art-26-gdpr/ https://gdpr-info.eu/art-26-gdpr/ IANAL etc.

Silhouette 8y ago
If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f). But if you're embedding a JS library from a CDN, then as a matter of fact, you aren't passing any data about your user to the third party at all. The user's browser is doing that as part of its normal operation. Moreover, as another matter of fact, you cannot have either any knowledge or any control over what happens next regarding any personal data the third party is collecting or how it is being processed, unless you have some separate arrangement with the third party that goes well beyond mere linking or embedding. Logically, it doesn't seem to make much sense for you to be either the controller or the processor in that instance. However, if the third party plays either role, they may have no mechanism to communicate with your site visitor to fulfil their obligations either.
- 8y ago