Re: [Doh] GDPR and DoH

[Stephen Farrell <[e-mail]>]

Hiya,

On 07/04/2019 09:43, Vittorio Bertola wrote:
> When someone signs up for Internet access with an ISP, the ISP gets
> them to sign a contract, which, in Europe, definitely includes
> privacy clauses; that is the place where the user provides explicit
> and informed consent to data processing, including for the DNS.
I just checked my ISP account's privacy policy and "contract
options." There is no mention of DNS at all. I didn't go chase
down the actual contract text but am happy to bet a beer that
DNS query privacy won't be mentioned there either.

So while I do agree that the centralising aspects of some kinds
of DNS deployment are a concern, I see no reason why that's any
different in real privacy or GDPR terms from the current
situation.

That said, it's maybe a hopeful sign that at least we're starting
to think about having operators publish policies as to their
handling DNS query info. If the mozilla/CF DoH setup prods DNS
operators to do that, that'll be good. (Do we have any examples
of DNS operators publishing such policy information for Do53?
Be good to see some if they exist.)

S.