6 ms·

CVS Pharmacy definitely includes the facebook scripts and hooks into every damn button you click on. Not sure what is "illegal" about the scripts themselves. I

CVS Pharmacy definitely includes the facebook scripts and hooks into every damn button you click on. Not sure what is "illegal" about the scripts themselves. I would tend, however, suggest that the sites using these scripts may be using them in ways that are illegal (as in HIPAA for instance in the US). Under HIPAA the violator would NOT be facebook, because they didn't install the script on other companies' sensitive sites, nor are they aware of such usages and they didn't sign BAAs with them. The ones that would be doing something illegal are the ones that sign BAAs or otherwise are directly responsible for keeping health information secure.

downandout 8y ago
This article isn’t about HIPAA, it’s about GDPR. If CVS does not have stores in the EU, then they’re most likely in the clear. Under Recital 23 [1], in order for the GDPR to apply to any site, the site must “envisage” serving EU customers. It would be a stretch to argue that a website designed to help customers of a chain of stores that has no presence in the EU does in fact “envisage” serving EU customers. [1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm http://www.privacy-regulation.eu/en/recital-23-GDPR.htm
- markarichards 8y ago
  It's not just about GDPR. It's about any regulated environment that requires systems and controls in place to maintain information security.
  - downandout 8y ago
    I don't know if you read it or not, but the article focuses mainly on GDPR. I’m apparently not the only one with this impression. The poster of this story on HN actually titled it “Facebook JavaScript SDK is often illegal under GDPR”. edit: Loving the downvotes on every comment I make regardless of content guys, keep them coming! You have about 13,000 to go before I get to 0, and you've only taken about 60 this week so far. At that rate it's going to take you a while, but I know you'll get there!
    - markarichards 8y ago
      Yes, I've added a focus on GDPR, but the article does state that this would often affect regulated contexts and I didn't intend the wording of that to be specific to the EU. Finance, healthcare, etc are all likely to include requirements for information security controls that go as specific as demanding access controls and audit logs; which appear completely impossible to achieve with what Facebook offer with their SDK. As an example, ICH GCP applies internationally for pharma. However, these are much smaller areas of regulation than most of us are not exposed to Whether all countries have more general provisions, like GDPR, that would apply to a very wide audience of businesses I don't know: but I know GDPR is now recognisable internationally and has parallels in many countries outside of the EU, so is hopefully a trigger for those in other areas to check what their privacy laws demand.
      - downandout 8y ago
        The term "illegal" with respect loading of the Facebook Javascript SDK these days is mostly a GDPR-invented issue. Since I doubt that Facebook is actually stealing data from the web pages its libraries reside on, it certainly isn't a HIPAA issue, and in the case of CVS, they aren't likely subject to GDPR at all (the comment I initially responded to was regarding CVS). Your general sentiment in your comment here is correct, that loading of any third party javascript library may be problematic for some sites depending on what jurisdiction(s) they do business in and what those libraries actually do. Merely having the capability to take data from a given page wouldn't be enough to trigger violations of many privacy laws (at least the in the US) - the library would actually have to be doing it. But the focus of the article is GDPR and Facebook JavaScript SDKs, and that is the context in which my comments should be viewed.
        untog 8y ago
        > Since I doubt that Facebook is actually stealing data from the web pages its libraries reside on, it certainly isn't a HIPAA issue "Stealing" is a loaded term here. I've observed myself that at least some pages with the FB SDK installed send a tracking HTTP request with every page click - FB appears to be hooking into some very high level page event. Depending on what content is on the page, I could see that being a HIPAA violation: even if they aren't deliberately doing it they could well be logging confidential data.

downandout 8y ago

This article isn’t about HIPAA, it’s about GDPR. If CVS does not have stores in the EU, then they’re most likely in the clear. Under Recital 23 [1], in order for the GDPR to apply to any site, the site must “envisage” serving EU customers. It would be a stretch to argue that a website designed to help customers of a chain of stores that has no presence in the EU does in fact “envisage” serving EU customers. [1] http://www.privacy-regulation.eu/en/recital-23-GDPR.htm http://www.privacy-regulation.eu/en/recital-23-GDPR.htm

markarichards 8y ago
It's not just about GDPR. It's about any regulated environment that requires systems and controls in place to maintain information security.
- downandout 8y ago
  I don't know if you read it or not, but the article focuses mainly on GDPR. I’m apparently not the only one with this impression. The poster of this story on HN actually titled it “Facebook JavaScript SDK is often illegal under GDPR”. edit: Loving the downvotes on every comment I make regardless of content guys, keep them coming! You have about 13,000 to go before I get to 0, and you've only taken about 60 this week so far. At that rate it's going to take you a while, but I know you'll get there!
  - markarichards 8y ago
    Yes, I've added a focus on GDPR, but the article does state that this would often affect regulated contexts and I didn't intend the wording of that to be specific to the EU. Finance, healthcare, etc are all likely to include requirements for information security controls that go as specific as demanding access controls and audit logs; which appear completely impossible to achieve with what Facebook offer with their SDK. As an example, ICH GCP applies internationally for pharma. However, these are much smaller areas of regulation than most of us are not exposed to Whether all countries have more general provisions, like GDPR, that would apply to a very wide audience of businesses I don't know: but I know GDPR is now recognisable internationally and has parallels in many countries outside of the EU, so is hopefully a trigger for those in other areas to check what their privacy laws demand.
    - downandout 8y ago
      The term "illegal" with respect loading of the Facebook Javascript SDK these days is mostly a GDPR-invented issue. Since I doubt that Facebook is actually stealing data from the web pages its libraries reside on, it certainly isn't a HIPAA issue, and in the case of CVS, they aren't likely subject to GDPR at all (the comment I initially responded to was regarding CVS). Your general sentiment in your comment here is correct, that loading of any third party javascript library may be problematic for some sites depending on what jurisdiction(s) they do business in and what those libraries actually do. Merely having the capability to take data from a given page wouldn't be enough to trigger violations of many privacy laws (at least the in the US) - the library would actually have to be doing it. But the focus of the article is GDPR and Facebook JavaScript SDKs, and that is the context in which my comments should be viewed.
      - untog 8y ago
        > Since I doubt that Facebook is actually stealing data from the web pages its libraries reside on, it certainly isn't a HIPAA issue "Stealing" is a loaded term here. I've observed myself that at least some pages with the FB SDK installed send a tracking HTTP request with every page click - FB appears to be hooking into some very high level page event. Depending on what content is on the page, I could see that being a HIPAA violation: even if they aren't deliberately doing it they could well be logging confidential data.