Re: [Doh] GDPR and DoH

[Vittorio Bertola <[e-mail]>]

>     Il 7 aprile 2019 alle 16.07 Stephen Farrell < [e-mail] mailto:[e-mail] > ha scritto:
> 
>     On 07/04/2019 14:33, Jim Reid wrote:
> 
>         > > 
> >     > 
>         > >         GDPR is already covered in the T&Cs between an ISP and the end user.
> >         Or should be.
> > 
> >     >     As far as DNS query privacy is concerned, that doesn't appear
>     to be explicitly mentioned by my ISP. Maybe that's an outlier
>     but I'd be surprised. So I don't accept that "already covered"
>     is correct, for DNS query privacy.
> 
I suspect that your ISP has a general consent request in their contract or privacy annex, in which they ask you for consent to treat any personal information that you provide or generate in the context of the Internet access service you are acquiring, for the purpose of what is necessary to provide you such access. That would cover treating DNS queries for giving you back IP addresses, though it would not cover any monetization of them, unless they also ask you for consent for the purpose of targeted advertising or other types of processing (except possibly any processing connected with network security, as that would likely fall under the exceptions to consent listed in the GDPR, as a legitimate interest and/or as necessary to comply with cybersecurity laws).

However, this would mean that DNS is already covered in legal compliance terms, but less so in terms of specific communication of what the operator does with your queries, and I agree with you that this is a different problem than legal compliance, though I disagree that it cannot be solved:

> 
>     (Separately, I also don't accept that one can get informed
>     consent from a person who doesn't understand the question being
>     asked. So from my POV, all this "click to accept" crap is
>     just crap and no more. I do realise that some lawyers likely
>     disagree.)
> 
One positive outcome of this discussion could be a collective attempt to define standard terminology and ways to communicate DNS operator behaviour and policies to final users. It would be great to see all recursor operators, ISP or OTT, communicate their DNS data policies clearly to final users, and uniformity would facilitate user education a lot.

>     Except people keep raising this as an issue, but without being
>     specific enough for me at least to understand if there is or is
>     not any effect on protocols.
> 
I think this was raised in the context of the discussion of DoH deployment policies and of the drafts that were meant to formalize the concerns and discuss best practices, and that, as I understand, are now frozen (hopefully not for long) waiting for the IESG to tell us if and where they can be discussed.

Ciao,

--

Vittorio Bertola | Head of Policy & Innovation, Open-Xchange
[e-mail] mailto:[e-mail] 
Office @ Via Treviso 12, 10144 Torino, Italy