Re: [Doh] GDPR and DoH

[S Moonesamy <[e-mail]>]

Hello,
At 01:43 AM 07-04-2019, Vittorio Bertola wrote:
>This said, since I am also one of the people that raised the GDPR 
>issue, let me provide a general view.
>
>GDPR (article 6.1: see 
>http://www.privacy-regulation.eu/en/article-6-lawfulness-of-processing-GDPR.htm 
>) requires that any processing of personal information related to a 
>European citizen happens only after the citizen has provided 
>explicit and informed consent (as defined in article 4.11 
>http://www.privacy-regulation.eu/en/article-4-definitions-GDPR.htm#a4_nr11 
>), except for a number of situations in which consent is not 
>required (legal obligations, life at stake, "legitimate interest"...).

>When someone signs up for Internet access with an ISP, the ISP gets 
>them to sign a contract, which, in Europe, definitely includes 
>privacy clauses; that is the place where the user provides explicit 
>and informed consent to data processing, including for the DNS.

There is a privacy clause in a contract with a service provider when 
the latter has to comply with the data protection regulations of the 
country in which it is operating.  The contract I am familiar with 
mentions the law which applies instead of the E.U. General Data 
Protection Regulation (GDPR).  It is up to the "data controller" and 
"data processor" to assess whether informed consent is needed.

The data protection angle of the DNS over HTTPS case is 
debatable.  It could be argued that DNS over HTTPS could be used for 
privacy-unfriendly purposes.  There might also be a dissonance with 
respect to BCP 188.

Regards,
S. Moonesamy