In one of our websites, there is a link pointing to a page to download some PDF files. Visitors have to submit their their name, job title, company, phone number and e-mail address and click a 'submit' button before landing at the page where the PDF file is hosted. However, the page where it collects name, e-mail address etc are not served through HTTPS. Personally, I think that any page that collects PII should be served through HTTPS, but I need something to present to the management before making this change (from HTTP to HTTPS). Does the practice of collecting the above details through a non-HTTPS page violates our policy if we are committed to protect PII of our customers and visitors?
Personal information (PII) Must be protected.
Name and emails are. IP address can be too.
If it's in your policy, you have to.
In Europe, it's an obligation, like in most countries.
So you must use https.
If you don't use https on all your pages including ones without PII, then you are vulnerable to MitM/sslstrip attacks, so you don't protect them correctly.
You should use https on all your pages and HSTS.