Bug 14242 allows to use the Google Book API to pull in information about a book from the ISBN or similar. At the moment the request is done in the browser, but for privacy concerns it would be better if the request could be made from the Koha server instead.
Do we have other stuff where Koha acts as a proxy?
If the GDPR was really enforced well, using a proxy would be an obligation since there is a reasonable solution to avoid altogether sending personal data to a 3rd party. Then just notifying the user is invalid since it's forcing them to accept a personal data transfer to use the feature when it's in fact unnecessary. When GDPR was coming up, I recall it was talked as having that impact. But obviously is a matter for enforcement to have an actual proceeding of a given complain. And then to have enforcement authorities decide that a data processing is unnecessary because there is a reasonable technical solution to avoid it and provide the same service.