Suppose a EU company provides me access to my personal information over HTTP, without even an option for HTTPS. Does that violate EU privacy laws? Can the company be compelled to fix its website, and how?

FWIW, I'd suspect subtler issues after I got a stack trace from their production server, but have nothing specific.

The actual company is a town-owned public utility providing water, and the website provides access to name, address, email, water bills and such. Customers don't have to use the website if they are fine with only traditional snail-mail bills.

Apologies if this isn't appropriate here—I'm guess it would be if I operated at the company. Feel free to move.

closed as off-topic by Steffen Ullrich, Anders, Tobi Nary, Serge Ballesta, TheJulyPlot Aug 10 '17 at 7:02

  • This question does not appear to be about Information security within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

  • the login might still be under https, but it should be updated anyway. – dandavis Aug 9 '17 at 17:10
  • 4
    "Does that violate EU privacy laws? Can the company be compelled to fix its website, and how?" - these are purely legal questions and thus off-topic here. Try law.stackexchange.com. – Steffen Ullrich Aug 9 '17 at 17:21
  • 1
    Sure, ask them who their DPO is and ask how the set up meets GDPR. – schroeder Aug 9 '17 at 19:06
  • @SteffenUllrich If the law asks for "reasonable steps", could it be on-topic here to ask what "reasonable steps" means in this context? Sebastian Nielsen's answer suggests less technical requirements than I expected. – Blaisorblade Aug 10 '17 at 19:46
  • @Blaisorblade: I would say that this would be about interpretation of law, i.e. off-topic. On-topic would be to ask about the implementation of specific of these steps. – Steffen Ullrich Aug 10 '17 at 20:10

It does not validate CURRENT privacy laws, as the CURRENT laws only state that you should secure the information - not how much and when - ergo, its only illegal with unsecured PII the moment a breach happens.

However, it would violate GPDR that is upcoming 1 july 2018 what I remember. However, not all PII needs to be secured. Its depends on what PII.

A IP-adress, username, email adress is considered PII, but such a low value that theres not much requirements on securing. How much PII must be secured depends on how sensitive the PII is, where medical data and crime data is considered the most sensitive, and pseudonyms (usernames, passwords) are considered the least sensitive PII.

An adress is however PII that is considered needing extra security. Same with water usage patterns.

  • 1
    "A IP-adress, username, email adress is considered PII, but such a low value that theres not much requirements on securing." is wrong. They should take reasonable steps to protect all PII. They can't do anything about the IP, but then can so they should protect username and email. – Tom Aug 10 '17 at 10:40
  • @Tom But they are still considered low-value according to law. A username is freely selectable, and can normally not be tied directly to a person. Same with email, you can select an email that is anonymous. So the requirements are pretty low on such harmless details. IP is more sensitive as that can in most cases be associated with a person, which would mean every server would need to be "resonable secured". And thzt eould be unresonable, so all PII is graded by its sensitiveness, where simple detsils like name is harmless and religion data/medical data/crime data is super sensitive. – sebastian nielsen Aug 10 '17 at 10:45
  • I also have seen the "reasonable steps" requirement—so maybe I should modify the question and ask if "HTTP login" can be considered reasonable in this scenario according to your professional opinions. Regarding passwords: they don't matter per se, but they still need to be secured as much as the data they protect. – Blaisorblade Aug 10 '17 at 19:43
  • @Blaisorblade In this case, it isn't resonable, but remember that GPDR isn't fully in effect now, it will be in full effect per 1 july 2018. (For most EU countries - there is always a grace period to allow for companies to change.). Some EU countries have already adopted GPDR with a grandfathering exception that current companies don't need to change before 1 july 2018, but new companies must follow GPDR, while other countries instead will adopt GPDR in 1 july 2018. So basically, no, the HTTP login isn't resonable as billing adress is sensitive, but you have to wait until GPDR is fully deployd – sebastian nielsen Aug 10 '17 at 21:25
  • @sebastiannielsen I should double-check the privacy laws in the country in question—I think we must already use "reasonable steps"; but that's indeed for law.sx. – Blaisorblade Aug 10 '17 at 21:34

Not the answer you're looking for? Browse other questions tagged or ask your own question.