Premium 'Recently Registered' email

This is utterly bonkers @MNHQ

Your database of opted-out users is fine for those who remain users but don't want marketing emails. You need to delete emails of those who deregister or change contact details though. What on earth makes you think its OK to keep a database of those contact details? What justifiable purpose does that serve?

"‘As soon as someone objects to or opts out of your marketing, you should add them to a ‘do not contact’ list. You should screen all your marketing against this list to make sure you don’t contact anyone who has opted out… You must not simply delete their details altogether, as you need to ensure they are not later put back on your marketing list by mistake.’ "

Again, you are still conflating marketing with retaining data. Two different things. When someone says "please delete my data" they are not saying "please keep my data but ensure you don't send me marketing emails".

It's been well established that the security of data has been compromised at MN in the past & you have been given detailed reasons why people deleted emails, accounts, changed emails etc. for reasons of concern over privacy.

I can only repeat that you have no justifiable reason to retain emails anywhere on your systems where people changed their emails (due to concerns over your ability to keep identifying information secure) when they should have been deleted at the time, but weren't because you system failed to do so. Having a list of emails you only have due to a system error is a list that should be deleted without any further delay.

You have to have a justifiable reason to retain & process data - marketing opt out doesn't apply here. So your excuse as to why you haven't just deleted this 'list' doesn't stand up.

As we said upthread, we completely agree that those who've asked for their emails to be changed shouldn't have their old email retained anywhere in the active mailing list in our email provider. That's what the mails we sent aimed to rectify.

Those who asked for their emails to be changed should have had their old emails removed completely, not just from the "active" mailing list. The mails you sent did not aim to rectify this as you stated the emails you sent would result in emails being added to the "do not contact" list. So, still retained, not removed as they should have been.

You're damn right you're making us jump through hoops.

I changed my email address linked to my account, because your track record with data security is sketchy to say the least.
At that point, my previous email should have been completely removed from your system. It wasn't.
I then get an email by mistake alerting me to your breach.
I then get another email with the option to "unsubscribe" from mailing lists.
By doing that, my email which should have been completely removed from your system a long time ago simply gets transferred to another list and you are still storing the data which I had previously asked to be removed.

What kind of system are you using? I wouldn't be surprised if it's a few excel spreadsheets from the sound of it. Instead of me emailing you and once again giving you the email address that I decided I didn't want you to have and asked you to remove, I think you should set someone the task of cross-referencing all your email lists, including your do not contact one, with email addresses that are currently linked to user accounts and delete the emails you are storing that are not linked to user accounts. Even if you are using excel, that's a fairly simple, if mind-numbingly boring task.

Is everyone affected a user from FWR?

Amy, you are conflating 2 very different things, and I can't tell whether it's just confusion or deliberate.

When people de-register, change their email or are banned, they do not expect their details to have been retained. At all. This isn't about subscribing to emails, it's about data that should not still be on your system and talking about subscriptions is not the same thing. You need a reason to retain data & you don't have one for this. Keeping a list of emails so that you don't email them is pretzel logic. You can also not email them by simply deleting the emails from your system. Your reason for retaining people's data (when you've already said it should already have been deleted & people would have expected that) is not justified.

Justine said;

@JustineMumsnet
Yes I completely agree. We'll mail everyone on our email database who isn't currently opted in to any newsletters to ask them if they'd like to be removed altogether. Thanks

But the email does not ask if we want to be removed from the database, it asks if we want to unsubscribe. There are 2 unsubscribe buttons and they seem to offer different options.

Why haven’t those who’s personal identification you’ve illegally kept been informed?

"Hi @Thelnebriati - unsubscribing removes users from the list of people we're able to send newsletters to.

If anyone wants their email address completely removed from the system please do mail in and we will action asap. Thanks"

Seriously? After this lengthy thread discussing how MN have retained data on people who are unaware, and how this breaches GDPR, you come back and say you still expect members & ex-members to contact you to have details removed?

Can anyone who has complained to ICO on this update the thread on where this is now? Because there appears to be a wilful attempt to both deny the unnecessary retention of personal data (only known due to an error in emailing marketing info from the 'wrong' list) & to not even inform those who still have their details retained that this is the case.

This isn't good enough @MNHQ

The email doesn't ask if we want the email address removed from the database, it asks if we want to unsubscribe from receiving emails.

No, I still haven't received it either

Did the emails go out yet? I haven't recieved one, and I haven't opted in to recieve newsletters.

@JustineMumsnet

Yes I completely agree. We'll mail everyone on our email database who isn't currently opted in to any newsletters to ask them if they'd like to be removed altogether. Thanks

Hi, Did you send out that email yet? I've not received anything.

Oh and just for the avoidance of doubt. If any of those old email address people asked to have their data deleted and/or not be contacted again. You have broken GDPR / DPA 2018 / UKGDPR.

A minor breach the ico are unlikely to be interested in over much. But still a breach.

Again. Sorry.

Also. WP29 (now EDPB) guidance is considered binding and it debars certain people who carry out particular functions in an organisation from holding the role of DPO.

And if you were an expert in data protection of the level to hold the role you’d know that, and know it couldn’t be you.

Sorry. Again.

You need a data protection officer. Mumsnet is the data controller.

If you’re responsible, you have a legal obligation to be the expert on all data protection matters and keep that expert knowledge up to date.

I don’t think you are at that level. Sorry.

You should have a data controller who is responsible for maintaining your data and systems, and who is answerable for errors.
And I think you should hire a database analyst to review and overhaul your system and staff training.

I do understand that you need to maintain a database of banned email and IP addresses, but they need to be on a separate encrypted database; not tagged in the main database, not in a separate table, and not available to interns or your email platform.

I think it would be more reasonable to send an email to all those on this 'do not use' list that shouldn't have been retained to confirm that this email is still on your database so they're all aware & can respond to confirm the data should be removed. This should not be left to individual members & ex members to contact MN to ensure action is taken.