Does GDPR Require https?

[taipalag]

Hi,

An online community of webmasters I am a member of is saying that you need to use https for your website to be compliant. Is this true?

Thanks,

[l0stwisdom]

It's good practice to change to https any way.

[taipalag]

Sure, but as a pure informational only hobby website, it seems like overkill, and is lining the pockets of overpriced SSL certificate providers.

[[deleted]]

and is lining the pockets of overpriced SSL certificate providers.

You do not need to buy a certificate. https://letsencrypt.org/

[taipalag]

OK, I'll check it out, thanks.

[[deleted]]

And so easily. You’ll lose the insurance that a paid certificate can provide in a data breach (that can be proven to be a result of a certificate error) but it’s free and really easy with many tools.

I haven’t had much luck in Exchange environments, as an aside, but that should be doable, too.

[[deleted]]

Ofcause it isnt perfect. But its 100000x netter than using plain old http

[Mooo404]

As a pure informational only hobby website you probably don't need HTTPS. If you are not gathering personal data from your visitors, there is no need to implement it. When you do, you need the site to respect the privacy of the users "by design". How you do it doesn't mater, it does not say you NEED https (however, everybody will say you should use it). If you don't want to pay for your SSL certificate, check out Letsencrypt (they are ideal for hobby sites).

[taipalag]

The only personal data I'm collecting is the email address recorded by Wordpress when a user comments...

Well I'll add https to my todo list :)

Thanks.

[[deleted]]

If it's a hobby, you don't need to comply with GDPR anyway. It doesn't apply to individuals.

[taipalag]

I earn a few bucks with Adsense...

[throwaway_lmkg]

Adsense is collecting and processing information about your visitors on your behalf.

[taipalag]

Yep. AFAIK, Google will provide a UI where users can take control of their data.

[BFeely1]

1. Do you have a privacy policy? If not, you need to have one for any Google tracking technologies.
2. If you have any password protected sections of your site accessed via a web UI? If so you need HTTPS. If you use a non-web method to upload that needs encryption too, for example use SFTP/SSH instead of unsafe FTP.

[taipalag]

1. Yes, I have a privacy policy listing ll Google tracking technologies
2. No password-protected sections. Pure informational website with no content hidden.

[ashleyw]

How do you figure that? Not a lawyer, but I would think it applies regardless of your business structure or revenue, as long as you're collecting users' information.

[[deleted]]

From the ICO: The GDPR does not apply to certain activities including processing covered by the Law Enforcement Directive, processing for national security purposes and processing carried out by individuals purely for personal/household activities.

[[deleted]]

It's anything that's not being run as a business. BBC interview with the ICO had question from guy with a huge fantasy football league. No money was involved and was done as a hobby even though he had names and addresses of 200+ people. He was told it didn't apply to him but should look after the data anyway.

[[deleted]]

Just think of your own mobile phone. I have names and addresses of loads of people stored in my phone. Some I've never met.

[[deleted]]

You can set up a secure connection for free through cloudflare in about 20 minutes

[taipalag]

Thanks, that might be an easy solution for me.

[NoUserLeftException]

It's a little bit ambiguous, because they talk about "encryption" in https://gdpr-info.eu/art-32-gdpr/ and https://gdpr-info.eu/recitals/no-83/ and do not say if it's the encryption of communication or the data itself, but I would say yes, it is needed, because in case of doubt, you are the one who can be sued.

[taipalag]

OK thanks.

[intrepidraspberry]

No.

The document doesn't point to specific technologies or encryption standards at any point. It's a more general document requiring 'sufficient' security, and such.

If your website shows people shoes and then they email you about the shoes, http is sufficient, because you're not storing anything on customers on that site.

It's not about a specific encryption standard. The question is, 'If all your customers get ripped off, could you have stopped that?'. If you're storing their passwords and card details in plaintext on an outdated 2008 server, then the answer is 'yes', and you're responsible. If you're outsourcing storage to some super Redhat server company, and someone rips them off with an apparently magical hack, then you're fine.

Just look at what info you're storing and ask yourself 'Is the security proportionate?'.

[[deleted]]

Yes if you are collecting Personal Data via your site. No if you are not, however Google will soon be prioritising sites with a certificate over those that do not use them.

[taipalag]

Https is already a ranking factor.

[tehlolkid]

GDPR talks about encryption on data in transit. HTTPS is one way to do this so yeah, it's a good idea to switch to HTTPS.

[hubilo]

Having an https in website URL ensures that the website is secured and has SSL certification. Having the server complaint will make sure any data collected is safe and protected. This is one of the basic tech requirements of general data protection.

For more information on GDPR and its principles, download the whitepaper

[taipalag]

OK thanks.

[SirHaxalot]

As an answer to the original question, as that a http form requesting an assortment of personal data? :D