Premium 'Recently Registered' email

There is another post on the Site Stuff board from someone yesterday night, explaining that they have twice asked MN to delete an email address of theirs and that MN haven't done it. Does MNHQ take data storage and protection seriously, or not? This clearly isn't a one-off.

Mumsnet Privacy Policy

(extract)

Our aims and duty of care
−
We recognise our duty of care with regards to your data and will always endeavour to do the right thing with the personal data you choose to share with us, including: not compromising your anonymity; protecting your privacy; storing your data securely and giving you control over your own data.

Our mission at Mumsnet is to help make parents’ lives easier. We believe that securing your data, preserving your anonymity, protecting your privacy, and giving you control over your data are an important aspect of that mission.

How long is your data held
−
Any personal data you give us, or that we collect when you use a Mumsnet product, will be retained by us for as long as it’s needed to perform its function. Registration data is held permanently unless you deregister. There’s no one-size-fits-all time limit, but we regularly review the data we hold to ensure it is still necessary. (continues)

We regularly review the data held by Mumsnet’s different teams and delete information that is no longer needed. All the data we hold is stored securely and only accessible to authorised staff members, who have regular data training.

On two previous occasions where Mumsnet members' data was breached, the retaining of previous email addresses was raised.

Many of the claims made in this policy statement are not backed up by the responses by senior Mumsnet staff.

I'm puzzled. When someone changed their email, why didn't you just overwrite the email address on the database?

Im actually quite shocked that you (MNHQ) have not addressed this properly and are effectively suggesting that people are lying. I am not and I'm sure the others aren't either, why would we.

After the previous data breach I deregistered my account and made this one with a email just for MN as it's clear GDPR and data safety isn't a concern to MNHQ.

The account I received the premium email to was that email address (my main one). It should not be on your system, you have no permission to store my deregistered data, or any data people have removed/changed.

I have submitted a complaint with screen shots of the emails and included a link to this thread. Hopefully it will be resolved that way and you start taking people's data seriously. It's not a "woops sorry, have some festive gin, teeheehee" situation, it's serious and you never seem to learn.

As per our message last night, if we have contacted you on an 'old' email address please do forward the email you received (to contactus@) and we will remove it from our email system asap

Are you saying you have no record of who you contacted? You sent bulk mail out without keeping the logfiles for even a few days?

This doesn't explain either the sending of mails to addresses which have never been registered as contact addresses with MN.

Data security should be taken far more seriously than a proverbial pat on the head and a "sorry you feel sad". Nope - there are actual laws to follow here.

MN does seem to have repeated, persistent problems managing users' data, then ignores queries when there are issues. It's a bit frustrating and doesn't really feel good enough given the users generate the content which makes the site so lucrative.

@MichaelMumsnet

Having investigated we are confident that we are not holding emails for users who have deregistered or unsubscribed - but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

Are you saying that users who claim to have asked you to delete their previous details when deregistering an account are lying?

No @MichaelMumsnet , quite frankly your explanation isn't good enough. Can you, or preferably @JustineMumsnet , answer the questions that you have been asked, including about the measures that are claimed to have already been in place, and about discrepancies in your privacy policy.

but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

@MichaelMumsnet

The issue with Mumsnet not deleting previously used email addresses has been raised in previous data breaches.

AuntieStella wrote Fri 08-Feb-19,

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)"

www.mumsnet.com/Talk/site_stuff/3501854-Mumsnet-data-breach-please-read?pg=33&messages=25

if users change their email addresses the old one isn’t automatically removed from our master email list
This issue was supposed to have been addressed from the last time there was a data breach.

What reason do you have for keeping the old email address?

Ah, so you've also confirmed you haven't broken any GDPR laws? Is that the "upset" you're referring to?

Quite disappointed by the lack of follow up on this after @MichaelMumsnet's 'it's fine, nothing to see here' dismissal. People have raised substantive points which should be addressed.

Mumsnet, we'd really appreciate it if you'd get back to us on this.

@JustineMumsnet

I click the links at the bottom of the email for if I didn’t want any more marketing or premium emails.

All it said when I clicked was “thank you for submitting the form”.

What exactly did I submit on the form?

Also, what’s your justification for making me submit twice - once for general marketing and offers and once for premium?

from the previously linked thread, AuntieStella wrote Fri 08-Feb-19 (p33),

" rowanmumsnet lilymumsnet nellmumsnet

With apologies for tagging all of you, but it's a bit difficult to work out who is actually handling which aspect of this.

We've had a big clear out post gdpr and deleted accounts that haven't opened mails for a bit, so not necessarily - only a proportion of those who've registered are on our email database. As said the email only contained the info in the OP here

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)"

There is no response on the thread.

I believe thats the same incident where @justinemumsnet made the comments in the photos I attached.

I remember that R0wantrees, I'm sure I posted about it or replied to a thread at the time as it happened to me. I logged in and was on somebody else's account, think I'd only noticed by going to reply and seeing the username. I'd completely forgotten about that!

Relevant context: I changed the email address associated with my account in February 2019 in response to a Mumsnet data breach at a time when threats to, ‘dox all of mumsnet’ were also being made by TRAs. Many women who were Mumsnet members did this.

previous thread, OP JustineMumsnet wrote,

(extract)
"What happened?
There was a problem affecting Mumsnet user logins between 2pm of Tuesday 5 February and 9am on Thursday 7 February 2019. During this time, it appears that a user logging into their account at the same time as another user logged in, could have had their account info switched.

Why has this happened?
We believe that a software change, as part of moving our services to the cloud, that was put in place on Tuesday pm was the cause of this issue. We reversed that change this morning. Since then there have been no further incidents.

How did Mumsnet find out this was happening?
Late last night, a Mumsnet user alerted us to the fact that they were able to log in to and view the details of another user’s account.

What information could have been affected?
If someone other than you logs into your account, they can see:
your email address
your account details
your posting history
your personal messages

We’re very sorry.
You’ve every right to expect your Mumsnet account to be secure and private. We are working urgently to discover exactly how this breach happened and to learn and improve our processes. We will also keep you informed about what is happening. We know some of you will be very worried by the possibility that your account has been breached (continues)

www.mumsnet.com/Talk/site_stuff/3501854-Mumsnet-data-breach-please-read

Two screen grabs of comments from @JustineMumsnet

One saying that a users details are deleted when they deregister. The other saying that they hold on to the email address of banned posters.
The comment that pre-GDPR they held on to the email addresses of deregistered users, suggests that since GDPR came into effect, this is something that no longer happens.

So what's going on? The actions don't match the claims, and your published Privacy Policy certainly does not seem aligned with how you are operating.

From MN privacy policy

How long is your data held+

Any personal data you give us, or that we collect when you use a Mumsnet product, will be retained by us for as long as it’s needed to perform its function.
Registration data is held permanently unless you deregister. There’s no one-size-fits-all time limit, but we regularly review the data we hold to ensure it is still necessary.

That suggest once you deregister, your information is no longer held, as it requires no function.

The section titled Your data - what we store and why lists a number of things that are held for users even if they are not registered, email address is not one of the things listed. However, you advertise that you store email addresses of registered users.

Why are you keeping a database of unregistered users?