Passport Info - SSL Needed?

[phunklord]

Hi all,

Random question: building a form for client. Most fields are pretty standard, except they are also asking for the user's passport info. Is SSL required for passport info? I feel like the answer is yes, but I'm not 100% sure as it's not something I've ever encountered before.

Thanks in advance for any insights!

pl

[williamc]

What sort of 'passport info' exactly? If it is anything at all, remotely sensitive, IE: anything not publicly available already, then an SSL would be the best route.

[Shift4SMS]

I would say yes but "legally" it depends on where the merchant resides. If the merchant is located in the US, Canada, most of Europe, and many other countries, it falls under various Personally Identifiable Information (PII) laws. Most PII laws say you must encrypt PII in transit and at rest and PII is usually defined as a name combined with any other piece of identifiable information -- like a drivers license number, passport number, social security number, credit card number, mailing address, etc. Even name with email address can be considered PII, but there are some exceptions related to public availability which email addresses usually falls under, but you would be wise to treat it as PII.

[Clarrie]

The fact that you are asking the question probably means the answer is yes - leaving aside the legal implications, if you are thinking the question, so will visitors, and adding SSL will add great reassurance and you're likely to get more people signup.

[DaveSawers]

I have to wonder what legitimate reason your client would have for asking for passport details.

Airlines need to as part of their check-in system and all of that needs to be secure.

Other possible uses? Can't immediately think of any.