Re: [Doh] GDPR and DoH

[Jim Reid <[e-mail]>]

> On 6 Apr 2019, at 19:53, Stephen Farrell <[e-mail]> wrote:
> 
> FWIW, I also don't get the GDPR angle here. If it's meant as
> an issue of consent related to selection of DNS server....
> 
> So can you explain the specific GDPR-related issue that you
> think is relevant?

Hi Stephen. When has relevance ever mattered on an IETF list? :-)

From a strict protocol design perspective, GDPR issues probably never matter for the IETF. After all the IETF doesn’t exist so it can’t be sued or prosecuted. GDPR does however have an impact on how IETF protocols get used and deployed. Sometimes that might impact need to be assessed in an IETF setting, just like how IETF docs are expected to have security and human rights considerations these days.

GDPR is already covered in the T&Cs between an ISP and the end user. Or should be. [You’ve probably been bombarded by GDPR tweaks to the T&Cs for your bank, utility providers, etc.] When DoH is used, this is likely to introduce third parties - the DoH service provider and a DoH client. GDPR compliance will be an issue for them, particularly the requirement to get meaningful consent from the end user. How these third parties do that is unlikely to be a topic for the IETF.

That said, I think it’s important that this WG is at least aware of these problems and documents them somehow. ie It produces an RFC which somewhere says something like "If you’re responsible for a DoH platform, make sure you’ve sorted out the GDPR concerns”.