- I am part of a non-profit club that has a form on the website for signing up for an email newsletter.
- The website (and thus form) is only available through through HTTP. HTTPS is not available on current infrastructure.
- There is no other data the interested party shares with us through this form, only a field for their email.
- The email distribution itself is later processed through a common service (such as Mailchimp, GetResponse or similar).
From a GDPR standpoint, will the club seen as negligent for accepting emails (which may be personally identifiable, and thus confidential?) over a knowingly insecure connection? Does it constitute a GDPR violation?