Personal data is any information relating to an identifiable person, whether that information is public or not. The student website is definitely processing personal data of faculty. Any website is also necessarily processing personal data of visitors due to technical reasons, even though hosting has been outsourced to a third party. There's always a server, you just might not be managing it yourself.
Thus, GDPR applies.
Just because it processes personal data doesn't mean that the student website would be illegal. It just means the students are responsible for GDPR compliance of that website. Since the website is controlled by students and not by the university, the university DPO has no say here and the university can't demand the website to be hosted in a particular manner. Nevertheless, the DPO's suggestions might be quite sensible.
Typical GDPR compliance steps include:
- having a clear purpose for which the personal data is being processed
- having a legal basis for that processing (here, probably a “legitimate interest” which will require a balancing test), see Art 6
- providing transparent information to the data subjects
- providing a privacy notice to website visitors, see Art 13
- notifying faculty per the requirements in Art 14 GDPR
- preparing to fulfill data subject rights such as access, rectification, and erasure
- when using a legitimate interest, there's also a right to “object” (opt-out)
- implementing appropriate technical and organizational measures to ensure security and compliance of your processing activities, see Art 24+32
- making sure that third parties to which you outsource processing activities are contractually bound as “data processors” to only use the data as instructed by you, see Art 28
- if you transfer data to non-European countries, having appropriate safeguards in place
Does this sound complicated? It can be complicated. The point is that the internet is no longer the lawless Wild West. Just because you can easily publish a site with personal data, doesn't mean that you should. The GDPR is about requiring data controllers to find an appropriate balance with the rights and interests of the affected persons. Of course there are countries with less regulation, but there are also countries with fewer taxes and that isn't necessarily good for society.
The easiest way to avoid these responsibilities will be to stop publishing the site as students – and instead taking up the university DPO's offer to have the university run the site. Which is less fun, of course, but the adult thing to do. If this motivates you further: note that the data controller (the people responsible for the site) must publish their contact information in the privacy notice, typically name + email + street address.
The GDPR contains no exceptions that would help here.
There is an exception for purely personal or household activities. But if the website would be available to the general public, it would be difficult to argue that this is purely personal. There's also case law such as the Lindqvist case requiring a narrow interpretation of that exception.
In Art 9, the GDPR does mention that some restrictions are lifted if the data subject made the information public themselves. But that isn't relevant here, because Art 9 is only about extra-protected sensitive data, e.g. health information, union membership, or sexual orientation.
