It's hit the press.

I was at a conference this week, and something that was said about behaviour modification really struck a chord. The speaker said that you can put in place all the systems you want to make people do things, in terms of education, reminders, emails, warnings, but even if they intend to comply with them, they likelihood is that some will, some won't, some will some of the time, so the average compliance won't be fantastic.

However, if you focus on systems that force compliance, such as (for e.g. in this case) having settings that hide personal data unless you enter two user's passwords, or having an obvious audit trail that is visible on the front screen, or having copy and paste either disabled, or automatically reported to an admin account, then compliance increases massively.

Examples I know of:

In Education, if files are accessed, an audit trail gets logged and an email account gets pinged to alert that personal files/details have been accessed, and the data controller (HT) has to click to say they've reviewed the access and it was legitimate.

In healthcare, every. single. time. I access a blood test record (I'm an audit nurse), I can see a hyperlink that says "audit trail". Before I was an audit nurse, and was clinical, I had never noticed it. Now I stare at the screen all the time, I got curious and clicked it. It logs every time that record is accessed, to the hour, minute, day and second, and by who. If I access my own/family/friend/colleague blood test results, I can be sacked. Same goes for anyone I know. Gross misconduct. I have to have a valid reason for logging in to a record. It's all recorded and there to see.

That should not be hard to achieve in MN and I think it is more important because, rightly or wrongly, there is a perceived anonymity here because of the freedom to namechange, which is better understood by those of us who have been here years to be no guarantee of cover.

messaged you, @ROwantrees

It's biased. It talks about Mumsnet's stance on trans rights. Mumsnet is taking a stance on freedom of speech and surely most of us here view this as about women's rights? I do.

Usual Guardian nonsense. I notice that they didn't refer to Emma's tweets in which she said "Fuck terfs" and "Fuck Mumsnet".

Guardian, you cannot die a fiery horrible painful financial death quickly enough. The founders of the Scott Trust would be turning in their graves if they saw what The Guardian is today.

I read that article last night, and thought it was unexpectedly slanted. I don't know what I expected, but that wasn't it. I got the impression (from the article) that she was some kind of martyr for her very just cause.

Why is Mumsnet encouraging her to delete evidence? Do they not understand that it is evidence?

The police should be able to recover what she deletes from her device, right?

If it is true that she has other MN related material, MNHQ should not permit her to delete it until they have confirmed what the material is and what she has done with it

How would they enforce that? How can they decide when she deletes something on her own private devices? She no longer works for them and they can't barge into her house and demand passwords to conform what she has. They have reported to the authorities and I can't see what else they can do apart from take her word for it.

EH disclosed information that she had collected over a 6 month internship.
She chose to publish this when she apparently became incensed that people on this forum were challenging the slideshow 'How To Deal with Terfs' which had been presented by an NUS Women's Officer & Trans Rights Office at NUS Women's 18. Twitter comments suggest a connection.
The NUS Women's officer (who identifies as non binary trans woman) requested via twitter that 'cis' friends challenge this.
There are legitimate questions to ask about activism with both LGBT and Women's groups at Oxford. The current challenge to Primark although referring to a Coventry store was raised by a friend (Oxford University) of the trans woman. From the initial tweet complaint, the suggestion is that a trans woman was asked for id prior (which they had) before going into the female changing rooms.
There are questions to ask about activism which supported T Wolf who was convicted of assault this week.
There are questions to ask about the activists who blocked entry to the meeting in Bristol this evening.
There are questions to ask about the possible connections...

Good. If Guardian readers are becoming puzzled about the way trans issues are being represented in the paper they may come here and have a look. I think it's great for helping peak people.

Also good to see Healey's contrition.

The article doesn't just give one side. Justine is quoted in some detail putting forward her point of view. She expresses herself with clarity and is quoted verbatim and not paraphrased.

Lizzie if a promise was given, it should have been accompanied by full disclosure by Emma of all the information she had (copies) given to MNHQ so MNHQ can fulfil their reporting and notification obligations.

Interesting that the Guardian is the first paper to pick this up. They never report any news related to TRAs unless it is positive. I don't think they reported the assault on MM or TW's conviction. No coverage of the advertisers putting pressure on MNHQ.

From what I've seen with other trans stories, one newspaper produces an article on a particular news story and then all the others just copy what they have written. If another paper had picked this up first it might have included the wider context (e.g. the attempts to stop women meeting, the assault on Maria, the pressure being put on MN's advertisers) and it might also have briefly outlined the issues and what the women she is objecting to actually believe. By printing it first without any of that context and just giving the transactivist's side of the story, I presume the Guardian are trying to set the narrative across the wider press.

Thanks Woman

I expect the promise from Emma, would have been extracted via a lawyer’s letter “asking” her to delete any further material. And pointing out what the consequences will be if she doesn’t.

Also sometimes the process of getting advice is flawed even if the advisor is knowledgable, especially if there's a budget to be managed. For example, the advisor might ask "do you process sensitive personal data?" without fully examining what the data is and how it is being used. The client might say no and really believe they don't but that's a legal and technical question and the advice will be flawed from that point. It might seem obvious that this shouldn't happen but it does.

Someone I know once said that clients being advised on data protection go through the five stages of grief: denial, anger, bargaining, depression before finally acceptance.

Thank you for that flora, it’s very interesting and the time you and other knowledgable posters have taken over this during the past 2 days is remarkable.

I've been using this NN for a long time and I don't want to change it so I try not to post anything that might identify me together with all the other things I've posted on here over the years.

It's not possible to tell what MN's governance, risk and compliance strategies are or whether they are adequate based on what they've told us so far. MN is quite a small company and although they have had previous experience of Jeffrey and other hacks, it's not easy to deal with a new experience (employee misuse) in the heat of an emergency situation.

You can have all the right strategies (I'm not saying MNHQ does) and still not anticipate employee misconduct. Although she was an intern, EH was an intern press officer whose professional responsibility is preserving the reputation of her employer. I don't think the fact she was an intern is, in itself, a problem if she really needed to have access to that information (which it turns out MNHQ decided she didn't need). It sounds like a professional internship rather than your next door neighbour's nephew on a make work project and the press officers I know would see what she has done as a career terminating move.

Your next door neighbour could have access to your bank account details if she works at a bank or can see what porn is watched on your TV pay per view if they work at your TV supplier or see your location at any given point if they have certain roles at your mobile phone provider or at an app which uses your location data. I once called my bank and it turned out I sort of knew the person on the phone who knows lots of people I know (got chatting while the system was lagging). I have to trust he is not going to tell them about my finances and I rely on his professional integrity and his employer's processes and willingness to fire and prosecute him if he does. The important thing is that there are good training programmes, technical and security measures, compliance etc. combined with robust sanctions on employees who breach that trust, including being sacked, reported to the police and any professional bodies and being sued by their employers.

MNHQ need to take these follow up steps just as seriously as reviewing compliance, security, technical measures, training, communications etc. if they want to send a message to future employees and also reassure their users they take value their privacy and will look after their data.

flora and bumble clearly work in this industry .... right now! I can only imagine how bizarre this must be to you to witness. So do MN not have a governance, risk and compliance strategy in place? Interns with that level of access? Sheesh.

I haven’t worked in IT for a while now (career changed) but even my out of date knowledge has left me cringing over this.

I just get the impression they are getting their IT Security advice from someone’s best friend’s brother, who once worked for Tandy.

She shouldn’t be allowed to delete it - it’s evidence and needs to be handed to the police.

If it is true that she has other MN related material, MNHQ should not permit her to delete it until they have confirmed what the material is and what she has done with it. She's just destroying what could be evidence of further breaches.

Really, she's going to delete it now?

The shit has already hit the fan for her, so what does she have to fear? What's stopping her handing over a data stick to someone else and denying all knowledge?

I've come to expect such bias from the Guardian that I'm impressed the article didn't use the terms transphobia or anti-trans but it does frame the 'dispute' as being over transgender rights with no mention of women's rights.

A spokesperson for Mumsnet said Healey had now promised to delete all other Mumsnet-related material.

This is the concerning part to me, what else was taken and how else has it been shared, she's shown herself to be untrustworthy so we will never know for sure.