Hacker News Reader

Comment by Silhouette | Hacker News Reader

There is a broader issue with web sites that incorporate external content that I haven't yet seen addressed.

The moment you load a resource on your page from an external source, you lose almost all control of what the operator of that external source does with any personal data that your visitor's browser sends to them, any cookies it sends with its reply, or what it does more generally in the case of executable resources.

Given that modern web sites routinely incorporate external assets for a multitude of reasons, has anyone ever found any official, authoritative guidance on who is the data controller or data processor in such cases, how they are expected to meet any obligations they have in terms of transparency and obtaining consent, or the related question of who is responsible for giving notifications or obtaining consent if required under the "cookie law"?

View on HN

The way I understand it it's extremely simple. Say you have a site. You are the contact point with the data subject, and therefore you are the controller. Anyone you subcontract spying on your users to is a data processor acting on your behalf, and therefore you are responsible for their behavior. You should have agreements in place with all your external resource providers that touch personal data. If any personal data leaks to them, you are responsible for notifying users of this and obtaining their consent if required. In most cases for external assets where no personal data is expected to flow to the asset provider (say loading fonts from a CDN) it's sufficient for the asset provider to give you their assurance that they don't collect or store data from visitors you send their way. If you have an adverterrorist-operated spyware embed like most ad networks on your site, then it's your responsibility to ensure that the adverterrorists are handling the data in a compliant way, and you need to notify your users of your relationship and obtain their consent to pass their data to a third party. Just because you are using a third party to do the spying does not remove your responsibility.

Say you have a site. You are the contact point with the data subject, and therefore you are the controller.

But that's not what how the controller is defined in the regulations. To be the controller, you must be "the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data". If you don't even have any way to know what personal data a third party is collecting or how it's being used, and you're linking to content that is freely available but over which you have no control, you're not even close to fitting that definition.

You should have agreements in place with all your external resource providers that touch personal data.

But that fundamentally breaks most of the modern WWW, which is not a reasonable thing to do. You can't even have a personal blog linking to a jQuery CDN to expand or contract your sidebar or Google Fonts to make things look pretty at that point.

Just because you are using a third party to do the spying does not remove your responsibility.

If they're spying at your request and on your behalf, that's one thing.

But it is inherent in the technologies of the web that third parties may be doing all kinds of things without your knowledge, consent or control. Moreover, even if you have somehow satisfied yourself that there is nothing inappropriate going on when you first incorporate external content in your page by reference, there is in general no technical mechanism to guarantee that the situation will not change later. In some limited cases tools like subresource integrity can help, but they only address specific parts of the general issue.

GDPR is explicitly agnostic to technical details (recital 15). The why is at least as important as the what. See the definition of controller in Article 4:

"‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data"

If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f). As long as you've performed a reasonable risk assessment about this activity and have records to prove it, you should satisfy your obligations as a controller under Chapter 4. If they go rogue and add a bunch of tracking scripts to the library, they're liable. You'd still need to notify about the breach.

If you're embedding a Javascript ad unit that does a bunch of tracking, you probably don't have a legitimate interest under Art. 6(1)(f), so you'll need consent. You're intentionally passing a bunch of personal data to a third party, so your responsibilities with regards to risk assessment are far greater. You and the ad provider probably constitute joint controllers under Art. 26.

https://gdpr-info.eu/recitals/no-15/

https://gdpr-info.eu/art-6-gdpr/

https://gdpr-info.eu/chapter-4/

https://gdpr-info.eu/art-26-gdpr/

IANAL etc.

If you're embedding a JS library from a CDN, then you have a lawful basis for passing the IP address of your user to a third party under Art. 6(1)(f).

But if you're embedding a JS library from a CDN, then as a matter of fact, you aren't passing any data about your user to the third party at all. The user's browser is doing that as part of its normal operation.

Moreover, as another matter of fact, you cannot have either any knowledge or any control over what happens next regarding any personal data the third party is collecting or how it is being processed, unless you have some separate arrangement with the third party that goes well beyond mere linking or embedding.

Logically, it doesn't seem to make much sense for you to be either the controller or the processor in that instance. However, if the third party plays either role, they may have no mechanism to communicate with your site visitor to fulfil their obligations either.

The law doesn't care how a browser works. The law doesn't care that it's the browser making the HTTP request. The law doesn't care if the JS library is delivered by pixies travelling through the ether on rainbows. You put the embed in that page, so you're responsible for what happens next. You acted (intentionally or negligently) to cause the user's browser to make a HTTP request to a third party, which might cause their personal data to be unlawfully processed.

You're not absolutely and totally responsible for anything that might possibly happen under any circumstances, but you're required to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation (Art. 24).

If you embed a JS library from Google Cloud CDN and compile a written risk assessment with copies of Google's privacy policy for that product and their EU-US Privacy Shield and ISO 27018 certifications, you're probably fine no matter what happens.

If you embed a JS library from SuspiciousCDN.ru because someone on 4chan gave you the link and your user data ends up on WikiLeaks, you're going to have some serious explaining to do.

But as I've already noted in other comments, this heavy-handed interpretation breaks a large part of the modern web, including many common practices that are in visitors' interests and not doing anything shady at all. Expecting every instance of embedding on the entire web, even among freely available pages using freely available services, to go full lawyer not just initially but on an ongoing basis, simply isn't a reasonable approach to take. An interpretation that puts significant extra liability on those freely offered sites and services regardless of whether they are intentionally doing anything shady is how you get extreme reactions like people geoblocking the EU.

If you're fine with running untrusted third-party code on your website, that's your prerogative. The European Union will shed no tears if you choose geoblocking over responsible business practices.

There is a difference between untrusted and unverified or informal.

Do I expect visitors to my personal blog to have any security or privacy problems because I use Google Fonts to make it look nice? No.

Do I have any sort of formal agreement that is binding on Google to guarantee that, or that obliges them to notify me if they change their privacy policy in this respect? Also no.

And exactly the same applies to, for example, numerous popular JS libraries that are hosted for free on reputable CDNs.

You're still the controller b/c you control the website they landed on. Presumably the user was trying to interact with you (as the website) and you get to say what does or does not go on to it.

It really all does revolve around control: as the website owner you can't control their ISP, Browser, VPNusage, etc. but you could trivially change your site from using Google Analytics to using a different system (or disable it altogether).

You're still the controller b/c you control the website they landed on.

But the regulations don't say anything about websites. Being a controller is about whether you determine the purposes and means of processing (even if someone else is then doing that processing). Merely embedding third party content on your site doesn't even give you knowledge of that processing, never mind any control over it.

Now, if you have a formal agreement with some other service that they will process personal data for some purpose and you will embed something in your page that gives them access to that data, obviously in that situation you're acting as controller. But huge amounts of the embedding that happens in the real world don't have those formal arrangements, and if you say no-one can ever embed anything any more without formal legal agreements to protect themselves, you break a large part of the modern web both technically and culturally. I don't think that was the intent of the new regulations, nor do I think it is a reasonable thing to do.

You don't understand it. It is your site, your users. If you enable 3rd party illegal tracking of your users by ANY means, it is your responsability too. To cover your back, you need to sign a legally valid contract (or they need to send you conformation) that they respect GDPR and assess their way of doing it (at least in this early stages, as very often, they are just trying to workaround it, which puts you in danger) to be absolutely sure about them. Analyitics, ad providers, CDNs, SaaS... all of them.

Take it as, "I control the door to a bank vault, if I allow robbers in, I will be a complice to a crime as the crime couldn't be commited without your help". Negligence or direct intent, it can be costly. Assess your 3rd party sources very carefully, I have already removed GA and replaced them with local analytics (https://matomo.org/) as I can't trust them, they are trying to downplay GDPR and there is already a complaint written against them (https://noyb.eu not for GA though), and I have read the PDFs, they are right and quite objectively, they are guilty. I dont want to be in a same boat with them.

That is one possible interpretation, but like many things around the GDPR, it is not what the regulation literally says nor how the technology actually works in practice, so other reasonable interpretations are also possible. I am asking whether there is any official, authoritative guidance on this.

Look, GDPR is not about technical means, it is about a concept. If the ICO proves to you that you are conceptually violating the GDPR by enabling 3rd party to violate it and you don't have your back covered, you wont have much to defend you with. You need to have a proof that you have done everything in your power to defend your users right to privacy and you were cheated by 3rd party. This is why all the fuss about GDPR was in last 6 months, you can't downplay the concept as it isnt saying anything what "script" or "service" (or cookies as an ultimate abuse of "concept of law" and an example why GDPR was written this way) you can use or not, it is just talking about user right to privacy and for you as data contoller, it is your duty to defend it.

Yes there is a guidance, it is called GDPR, it is THE only guidance, just take the concepts, I can give you this link, it is the best I was able to find, it will help understand the GDPR, but for each and every site, owner needs to decide on its own: https://www.youtube.com/watch?v=-stjktAu-7k

Sorry, but it's not that simple. A lot of the fuss about the GDPR is because it introduces significant uncertainty combined with the potential for severe penalties if your interpretation differs from the regulators. It is not unreasonable to look for concrete, actionable guidance to reduce that uncertainty.

The modern web depends on embedding third party content for many reasons, most of which have nothing to do with invading anyone's privacy and many of which are directly in the visitor's interests. It is not helpful to undermine that whole ecosystem and expect everyone to start having formal contracts in place before they can take advantage of any of those services. Nor is it reasonable to expect services offered for free that aren't doing anything shady to take on significant liability and/or other commitments anyway through formal agreements with their users. Why would they do that, instead of just (as obviously quite a few places already have) geoblocking the EU to remove themselves from the scope of the onerous rules?

Silhuette, I am sorry, I have tryed to help you, thank others, maybe you/others will believe a lawyers in following months, but they wont be free. (And special thanks to HN, preventing me to answer with its policy of "answering too fast", I had an explanation for you, but I was unable to answer)

To the morons (no, it is not insult, it is empirical fact) downvoting me, it is not me, it is GDPR, face the reality, it is not my fault that you are too reluctant to understand it and biting people trying to help you out wont help. Downvoting me wont change GDPR or change anything, you will just loose a valuable source of information as you did just now. Go to the first psychiatrist and it will tell you that a reality will be as it is even if you close your eyes (or shoot the messenger =/).

Don't forget to upvote me, when you figure out I was right and you get a warning/fine.

We've banned this account for breaking the site guidelines.

If you don't want to be banned, you're welcome to email hn@ycombinator.com and give us reason to believe that you'll follow the rules in the future.

Reply on news.ycombinator.com