Covered entities are still responsible for responding to request for access within 30 days (in most cases). (geminisecurity.com)
That means that most requests for access to data at business associates will be initiated by the covered entity. (geminisecurity.com)
While recent versions of Messenger and Facebook Lite on Android devices have made specific requests for access to call and SMS logs — part of the social network's efforts to improve its friend recommendation algorithm — Facebook may have already been able to access the data for years. (slashgear.com)