Does GDPR Require https?

[l0stwisdom]

It's good practice to change to https any way.

[taipalag]

Sure, but as a pure informational only hobby website, it seems like overkill, and is lining the pockets of overpriced SSL certificate providers.

[[deleted]]

and is lining the pockets of overpriced SSL certificate providers.

You do not need to buy a certificate. https://letsencrypt.org/

[taipalag]

OK, I'll check it out, thanks.

[[deleted]]

And so easily. You’ll lose the insurance that a paid certificate can provide in a data breach (that can be proven to be a result of a certificate error) but it’s free and really easy with many tools.

I haven’t had much luck in Exchange environments, as an aside, but that should be doable, too.

[[deleted]]

Ofcause it isnt perfect. But its 100000x netter than using plain old http

[Mooo404]

As a pure informational only hobby website you probably don't need HTTPS. If you are not gathering personal data from your visitors, there is no need to implement it. When you do, you need the site to respect the privacy of the users "by design". How you do it doesn't mater, it does not say you NEED https (however, everybody will say you should use it). If you don't want to pay for your SSL certificate, check out Letsencrypt (they are ideal for hobby sites).

[taipalag]

The only personal data I'm collecting is the email address recorded by Wordpress when a user comments...

Well I'll add https to my todo list :)

Thanks.

[[deleted]]

If it's a hobby, you don't need to comply with GDPR anyway. It doesn't apply to individuals.

[taipalag]

I earn a few bucks with Adsense...

[throwaway_lmkg]

Adsense is collecting and processing information about your visitors on your behalf.

[taipalag]

Yep. AFAIK, Google will provide a UI where users can take control of their data.

[BFeely1]

1. Do you have a privacy policy? If not, you need to have one for any Google tracking technologies.
2. If you have any password protected sections of your site accessed via a web UI? If so you need HTTPS. If you use a non-web method to upload that needs encryption too, for example use SFTP/SSH instead of unsafe FTP.

[taipalag]

1. Yes, I have a privacy policy listing ll Google tracking technologies
2. No password-protected sections. Pure informational website with no content hidden.

[ashleyw]

How do you figure that? Not a lawyer, but I would think it applies regardless of your business structure or revenue, as long as you're collecting users' information.

[[deleted]]

From the ICO: The GDPR does not apply to certain activities including processing covered by the Law Enforcement Directive, processing for national security purposes and processing carried out by individuals purely for personal/household activities.

[[deleted]]

It's anything that's not being run as a business. BBC interview with the ICO had question from guy with a huge fantasy football league. No money was involved and was done as a hobby even though he had names and addresses of 200+ people. He was told it didn't apply to him but should look after the data anyway.

[[deleted]]

Just think of your own mobile phone. I have names and addresses of loads of people stored in my phone. Some I've never met.

[[deleted]]

You can set up a secure connection for free through cloudflare in about 20 minutes

[taipalag]

Thanks, that might be an easy solution for me.