If you are processing the IP address in order to respond to the HTTP request, you are definitely processing personal data[1][2][3]. The fact that you are not keeping any logs would be considered a technical measure to reduce the risk associated with processing (and you should definitely do what you can to reduce that risk, including avoiding processing or storing data unless it's actually necessary).
In GDPR, processing needs to have a legal basis (Art. 6 GDPR). In this case, you would probably chose Art. 6(1)(b) (if you have or are preparing to enter into some kind of contract with the data subject and that's why you are processing their data), or Art. 6(1)(f) (your legitimate interest as a controller) as the legal basis for processing the IP address (also don't forget about the all the headers sent by the browser).
So by figuring out what your legal basis is for each category of data, you can process data lawfully and be compliant.
On the question of the data protection officer: a DPO is someone who is appointed by you to independently protect the interests of the subjects (you can't do it yourself as that would be a conflict of interest). However, in your case, there is a good chance that you don't need to appoint a DPO. (See Do we need to appoint a Data Protection Officer?
The derogations of article 85 probably don't mean that you can ignore GDPR for these purposes, but merely that there will be special provisions (for instance, you can probably not use your right to object to the processing of your data to prevent a newspaper from writing an article about you).
The question of whether this is "a purely personal or household activity" is a little bit more complicated. Recital 18 says:
(1) This Regulation does not apply to the processing of personal data by a natural person in the course of a purely personal or household activity and thus with no connection to a professional or commercial activity. (2) Personal or household activities could include correspondence and the holding of addresses, or social networking and online activity undertaken within the context of such activities. (3) However, this Regulation applies to controllers or processors which provide the means for processing personal data for such personal or household activities.
If you (or your blogging software) were to integrate Google Analytics for instance, I would say you are quickly entering the realm of "potential adverse effects" on the data subject, and so you should not rely on this as your legal basis for ignoring the GDPR (especially as it would not be super difficult to comply).
In my estimation, if you are practicing anything that could be called journalism, you are very likely out of the scope of the household exception.
Otherwise it's definitely possible to argue that blogging is a personal activity. You should make sure that:
- You are not doing anything that could be considered commercial or organised
- You don't disseminate personal data (this may not be so easy)
- You don't pose a risk to the rights and freedoms of the reader (i.e. you don't put their privacy at risk in any way)
Alternatively, you may chose to spend the time (and money) to create a privacy policy and be compliant even though you don't necessarily have to.
Sources:
- http://www.privacy-regulation.eu/en/recital-30-GDPR.htm
- https://eugdprcompliant.com/personal-data/
- https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal-data/
