Private Messages Deleted

[GertieMotherwell]

Anyone else having a message saying
‘this message has been removed as user request’

Have they been hacked?

@aswellihavehayfever

I think it looks like if the person you sent the message to deletes it at their end, it deletes it from your sent box and you get that "this message has been deleted..."

This is what's going on and embarrassingly, I'm not sure if this is intentional or not... I do know our tech team has been investigating, so it does sound like something they are trying to fix. Will update when we have more info.

Does deleting them just delete them from your folder or are they completely deleted off mn servers and even mn staff can't access them?
Well let’s hope not behave would be a very serious data breach by MN.

@LornaMumsnet(MNHQ)
This is what's going on and embarrassingly, I'm not sure if this is intentional or not... I do know our tech team has been investigating, so it does sound like something they are trying to fix. Will update when we have more info

Sorry this isn’t good enough. This is way more than just an embarrassing glitch. This is fundamental to sensitive data protection. You seem to be a bunch of amateurs and more worryingly you don’t even realise and post messages like the above like it’s all a bit of a joke. Less than six months ago Twitter was embroiled in a problem where some non high level administrators might have seen DMs and private data, let alone randomly deleting them at will. Just to clarify: the sent PM data belongs to the sender. The received PM data belongs to the recipient. Not vice versa. And not to you, MNHQ. You cannot delete other people’s data without their knowledge or consent. You need to employ some people who know what they’re doing because ‘mistakes’ like this worry me immensely as they are fundamental and makes me wonder what else are you not adhering to that just hasn’t been discovered yet. Data protection isn’t a fire fighting exercise it should be locked down, unequivocally. I am very careful with social media and never post anything I wouldn’t be happy having on a sign post in my local town square. Lots of people however, particularly in the very sensitive areas of MN like FWR or DA threads do post sensitive and private data in their PMs. You clearly cannot be trusted with it. And your jolly hockey sticks attitude of ‘oh how embarrassing, silly us’ is unbelievable.
Further what is the ‘fix’? To ensure the message is not deleted from the recipients inbox? What do you plan to do? How and when will you return the deleted data, in the PMs, to the owner? What are your data protection policies? Do they adhere to current legal requirements? And, pertinently, do your systems adhere to your policies?

Where do our deleted messages go MNHQ? I have cleared out my inbox and sent mail of everything as I no longer feel remotely protected by the security set up here. There was sensitive information in there. I would like these emails to be completely deleted from everywhere as it surely my right? Surely they are not now sat on your servers.

I am shocked by the lackadaisical approach to data protection that seems to be rife at MNHQ. It is not good enough when people are here for support and sharing extremely sensitive information.

I'd like to know where our deleted messages to too.

Judashascomeintosomemoney, could you explain what legislation requires websites to keep a copy of users' data, i.e. prevents them from deleting it without the user's permission? How long are they required to retain it for? What if the owner wants to turn off the website permanently, what does the law say they would have to do with personal data they are storing?

Hi all - thanks for raising this and we’re really sorry that it took you unawares. It’s something that we put in place in the run up to GDPR, because we took the view that in situations like this, we need to privilege the right of users to delete their data.

In the case of PMs, messages by poster A can often contain personally identifying information about poster B. Because we’re putting poster B’s right to delete her data above other concerns, when poster B deletes a PM that was sent to her, the PM is deleted from our servers and will disappear from poster A’s ‘sent’ folder .

Likewise, if poster B de-registers or asks us to delete all her data, we think she will rightly expect PMs between herself and poster A to be deleted from our servers. That means they’ll also disappear from poster A’s ‘sent’ folder.

It’s a bit of a compromise I’m afraid. One thing we can do, though, is to make it much clearer at the point of deletion that removing messages from your inbox will also remove them from the ‘sent’ folder of the person who sent them.

@LassWeADelicateAir - please let us know if PMs continue to disappear. It may be that the sent messages are part of a long conversation - and if the author deletes their part of the conversation, then yes, the messages will be removed.

@ R0wantrees - PMs being added to a thread is definitely not right and we’ve raised it as a matter of urgency with the tech team. Please could you drop us a line to [email protected] with the thread that it happened on, to give them a steer?

Many thanks, M.

@MichaelMumsnet I have PM ed you.

Hi @FreudianSlurp If someone is sending you unwanted PMs then please let us know.

You can block a poster from sending you more private messages by clicking the red 'Block' icon next to their name on a message to you.
There's more detail about PMs here - www.mumsnet.com/info/private-messaging

Can you please explain why you are seeing deleting a message you have received as the same as a request to erase data?

If the pm is delete from your servers at the same time as the sender deletes it, can you please explain how you will retrieve that to use as evidence if there is a case of harassment or abuse?

Can you please explain why, if this was put in place in advance of GDPR, members were not made aware of this change?GDPR came in on 25th May and this is 2 July.

Thank you.

This approach does seem to open up lots of other issues ...

Nothing in GDPR says that all copies of emails (which messages are analogous to) should be deleted when someone is just clearing out their inbox.

Bumping

I would really like an answer please

bump

I guess this mainly comes down to how the messaging is implemented. There is a single record for each PM, with a sender and a receiver. If either one deletes it then the record is gone for both. They need to allow people to delete their messages, they don't want to 'secretly' keep it on their server just so that the other party can still view it, and they don't have the time/resource to completely rewrite the messaging system.

R0wantrees - PMs being added to a thread is definitely not right and we’ve raised it as a matter of urgency with the tech team. Please could you drop us a line to [email protected] with the thread that it happened on, to give them a steer?

@MNHQ I haven't had any follow up with regards this issue.

Is it possible to discuss this please ?