Re: [Doh] GDPR and DoH

[Stephen Farrell <[e-mail]>]

Hiya,

On 07/04/2019 18:23, Vittorio Bertola wrote:
> I suspect that your ISP has a general consent request in their
> contract or privacy annex, in which they ask you for consent to treat
> any personal information that you provide or generate in the context
> of the Internet access service you are acquiring, for the purpose of
> what is necessary to provide you such access. That would cover
> treating DNS queries for giving you back IP addresses, though it
> would not cover any monetization of them, unless they also ask you
> for consent for the purpose of targeted advertising or other types of
> processing (except possibly any processing connected with network
> security, as that would likely fall under the exceptions to consent
> listed in the GDPR, as a legitimate interest and/or as necessary to
> comply with cybersecurity laws).
> 
> However, this would mean that DNS is already covered in legal
> compliance terms, but less so in terms of specific communication of
> what the operator does with your queries, and I agree with you that
> this is a different problem than legal compliance, 

I read their privacy policy and a bunch of other information
they make easily available and am none the wiser as to what
they do or don't do with DNS data. I'm pretty sure that nobody
who didn't know that DNS exists could appreciate these issues
based on the text that ISP makes available.

(Maybe I'll ask them about it for a laugh, but that tends to
be very time consuming with little payoff. I'll see how bored
I get in the next few days:-)

> though I disagree
> that it cannot be solved:

I never said there were unsolveable problems here.

I said that DoH doesn't create any new privacy/GDPR problems.
The interesting privacy/GDPR problems related to DNS aren't
DoH specific. Those can definitely be analysed objectively
(i.e. without trying to make DoH seem bad:-) and we could
document the results so that operators could more easily
make clear statements about this (or be called out for not
doing so).

I also said that I think most of how the IT business treats
so-called "consent" is rubbish. That could be fixed in theory
if we had an epidemic of honesty, so while the solution is
utterly obvious, I'm not at all hopeful there;-)

Cheers,
S.