Feeds

NHS enables Facebook to track surfers on health info website

Privacy experts say 'ick, germs'

Providing a secure and efficient Helpdesk

Privacy experts have expressed dismay at a decision by the NHS to allow Facebook and Google to track users on one of its sites.

The NHS has integrated its NHS Choices site into the Facebook Connect platform, so that surfers can express an interest ("like") for pages on the site and share content with their friends and contacts on Facebook. Google is also able to track the behaviour of individuals on the NHS Choices website, online privacy firm Garlik warns.

Garlik is sharply critical of the designers of the site. Mischa Tuffield, a developer at Garlik, criticised the design decisions as either "ill judged or ill informed".

Most of Tuffield's criticism focuses on the tie-up between the health information site and Facebook Connect which "opens the door to third-party tracking", even in cases where a user is not logged into Facebook at the time of visiting the NHS Choices site.

The site also uses analytics services from Google and Webtrends, something Garlik argues should not be trusted to a third-party supplier, as outlined here. However, it reserves the bulk of its criticism for the tie-up with Facebook.

Tuffield writes: "What right has the NHS to share any information about the browsing of NHS Choices with Facebook? The Like button is engineered such that even if it is not clicked, it still passes information about the user to Facebook, even if they are not logged into Facebook at the time of the visit."1

Garlik, which was the first to warn of the issue, was able to establish that tracking took place using internet logging tools. It knows from this exercise that individually identifiable data is exchanged between NHS Choices and Facebook, but not how it is used.

Users can be expected to be viewing content on NHS Choices that most might normally be expected to want to keep private. Garlik offers an example of a young mother looking for information on post-natal depression, but many others can be imagined.

The sharing is mentioned in the NHS website privacy policy, something few average punters would read, and a point that cuts little ice with Garlik or other critics.

Andy Thomas, Garlik’s managing director, said: "The fundamental issue here is that the NHS believes it is acceptable to share information about users' browsing habits with third parties. This appears to have been a conscious decision, and the NHS believes that a statement buried away in a privacy policy makes it OK."

"NHS Choices has either wilfully decided that sharing the pages visited by all Facebook users with Facebook is acceptable, or has implemented the technology without understanding how it works."

The issue has been taken up by Tom Watson MP, who wrote to the Health Secretary on Tuesday to express his concern that the "NHS is allowing Google, Facebook, and others to track your nhs.uk browsing habits, regardless of the fact that people use the page to seek medical advice".

"The NHS Choices website is used by members of the public in order to find out facts about ailments they may be suffering from and these illnesses could cause an individual embarrassment if the information was leaked," he writes.

Watson wants the link between NHS Choices and Facebook Connect to only exist in cases where users opt in to link the services, rather than (as now) by default.

Choosing a cloud hosting partner with confidence

More from The Register

next story
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.