Premium 'Recently Registered' email

[SantasBritchesSpelleas]

I had an email advertising Premium saying 'We noticed you recently registered with Mumsnet'. I registered several years ago! Is this an error or is it like moving into a small village where you're still considered an incomer 20 years later?

@Lucylaine

Had the same email to an account/email address I specifically asked them to remove after their second to last data breach. So MN HQ, what the hell are you still doing with that data? It's a GDPR breach that you would still even have that.

I have the same issue @MichaelMumsnet , you do not have permission to hold my previously used email address on a database. Its a GDPR breach.

The cheek of it to admit to holding people's data against their will, and then claiming it's not a GDPR breech. Ffs.

"Article 5 of the GDPR sets out seven key principles which lie at the heart of the general data protection regime.

Article 5(1) requires that personal data shall be:

“(a) processed lawfully, fairly and in a transparent manner in relation to individuals (‘lawfulness, fairness and transparency’);

(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes (‘purpose limitation’);

(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);

(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);

(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals (‘storage limitation’);

(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).”

Article 5(2) adds that:

“The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).”

:ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/

Anyone wanting to make a complaint can check into it further here:

www.gov.uk/data-protection/make-a-complaint

I, for one, would be trusting the the govt website above and beyond MNHQ.

Thanks, I have done.

From MN privacy policy

How long is your data held+

Any personal data you give us, or that we collect when you use a Mumsnet product, will be retained by us for as long as it’s needed to perform its function.
Registration data is held permanently unless you deregister. There’s no one-size-fits-all time limit, but we regularly review the data we hold to ensure it is still necessary.

That suggest once you deregister, your information is no longer held, as it requires no function.

The section titled Your data - what we store and why lists a number of things that are held for users even if they are not registered, email address is not one of the things listed. However, you advertise that you store email addresses of registered users.

Why are you keeping a database of unregistered users?

Two screen grabs of comments from @JustineMumsnet

One saying that a users details are deleted when they deregister. The other saying that they hold on to the email address of banned posters.
The comment that pre-GDPR they held on to the email addresses of deregistered users, suggests that since GDPR came into effect, this is something that no longer happens.

So what's going on? The actions don't match the claims, and your published Privacy Policy certainly does not seem aligned with how you are operating.

Relevant context: I changed the email address associated with my account in February 2019 in response to a Mumsnet data breach at a time when threats to, ‘dox all of mumsnet’ were also being made by TRAs. Many women who were Mumsnet members did this.

previous thread, OP JustineMumsnet wrote,

(extract)
"What happened?
There was a problem affecting Mumsnet user logins between 2pm of Tuesday 5 February and 9am on Thursday 7 February 2019. During this time, it appears that a user logging into their account at the same time as another user logged in, could have had their account info switched.

Why has this happened?
We believe that a software change, as part of moving our services to the cloud, that was put in place on Tuesday pm was the cause of this issue. We reversed that change this morning. Since then there have been no further incidents.

How did Mumsnet find out this was happening?
Late last night, a Mumsnet user alerted us to the fact that they were able to log in to and view the details of another user’s account.

What information could have been affected?
If someone other than you logs into your account, they can see:
your email address
your account details
your posting history
your personal messages

We’re very sorry.
You’ve every right to expect your Mumsnet account to be secure and private. We are working urgently to discover exactly how this breach happened and to learn and improve our processes. We will also keep you informed about what is happening. We know some of you will be very worried by the possibility that your account has been breached (continues)

www.mumsnet.com/Talk/site_stuff/3501854-Mumsnet-data-breach-please-read

I remember that R0wantrees, I'm sure I posted about it or replied to a thread at the time as it happened to me. I logged in and was on somebody else's account, think I'd only noticed by going to reply and seeing the username. I'd completely forgotten about that!

I believe thats the same incident where @justinemumsnet made the comments in the photos I attached.

from the previously linked thread, AuntieStella wrote Fri 08-Feb-19 (p33),

" rowanmumsnet lilymumsnet nellmumsnet

With apologies for tagging all of you, but it's a bit difficult to work out who is actually handling which aspect of this.

We've had a big clear out post gdpr and deleted accounts that haven't opened mails for a bit, so not necessarily - only a proportion of those who've registered are on our email database. As said the email only contained the info in the OP here

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)"

There is no response on the thread.

I click the links at the bottom of the email for if I didn’t want any more marketing or premium emails.

All it said when I clicked was “thank you for submitting the form”.

What exactly did I submit on the form?

Also, what’s your justification for making me submit twice - once for general marketing and offers and once for premium?

Mumsnet, we'd really appreciate it if you'd get back to us on this.

@JustineMumsnet

Quite disappointed by the lack of follow up on this after @MichaelMumsnet's 'it's fine, nothing to see here' dismissal. People have raised substantive points which should be addressed.

Hello, and thanks for bearing with us while we’ve taken a thorough look at this.

We mistakenly sent an email that was part of our welcome journey for new members, to our full database of emails - apologies again for that.

Having investigated we are confident that we are not holding emails for users who have deregistered or unsubscribed - but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

Please let us know if you have any further concerns and we’ll be happy to check your permission details to make sure everything is as you want it (for example, it’s quite common for people to unsubscribe from an email, thinking they’ve unsubscribed from all emails, when in fact they’ve only unsubscribed from the one they are currently reading).

Apologies once again for any upset.
MNHQ

Ah, so you've also confirmed you haven't broken any GDPR laws? Is that the "upset" you're referring to?

if users change their email addresses the old one isn’t automatically removed from our master email list
This issue was supposed to have been addressed from the last time there was a data breach.

What reason do you have for keeping the old email address?

@Nnkk

I click the links at the bottom of the email for if I didn’t want any more marketing or premium emails.

All it said when I clicked was “thank you for submitting the form”.

What exactly did I submit on the form?

Also, what’s your justification for making me submit twice - once for general marketing and offers and once for premium?

Can I ask this again?

but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

@MichaelMumsnet

The issue with Mumsnet not deleting previously used email addresses has been raised in previous data breaches.

AuntieStella wrote Fri 08-Feb-19,

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)

I asked earlier in the thread about whether the promised deletions of old email addresses had taken place. Could you give a simple yes/no answer to that please?

(Background: in one of the previous security breaches, it became clear that MN was keeping old email info, even when members updated their details. MNHQ undertook to delete all past addresses and keep only the up to date one. Has that taken place?)"

www.mumsnet.com/Talk/site_stuff/3501854-Mumsnet-data-breach-please-read?pg=33&messages=25

@MichaelMumsnet

Hello, and thanks for bearing with us while we’ve taken a thorough look at this.

We mistakenly sent an email that was part of our welcome journey for new members, to our full database of emails - apologies again for that.

Having investigated we are confident that we are not holding emails for users who have deregistered or unsubscribed - but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

Please let us know if you have any further concerns and we’ll be happy to check your permission details to make sure everything is as you want it (for example, it’s quite common for people to unsubscribe from an email, thinking they’ve unsubscribed from all emails, when in fact they’ve only unsubscribed from the one they are currently reading).

Apologies once again for any upset.
MNHQ

Can I just clarify that you are saying that you will get rid of old email addresses when people change them from now on, but you won't be doing this retrospectively?

No @MichaelMumsnet , quite frankly your explanation isn't good enough. Can you, or preferably @JustineMumsnet , answer the questions that you have been asked, including about the measures that are claimed to have already been in place, and about discrepancies in your privacy policy.

@MichaelMumsnet

Having investigated we are confident that we are not holding emails for users who have deregistered or unsubscribed - but if users change their email addresses the old one isn’t automatically removed from our master email list, which is why on Xmas eve, you might have received a mail for an account that you no longer use for Mumsnet.
We’ll make sure that in future old emails are automatically removed from the list when users update their details.

Are you saying that users who claim to have asked you to delete their previous details when deregistering an account are lying?

MN does seem to have repeated, persistent problems managing users' data, then ignores queries when there are issues. It's a bit frustrating and doesn't really feel good enough given the users generate the content which makes the site so lucrative.

@thecognoscenti

MN does seem to have repeated, persistent problems managing users' data, then ignores queries when there are issues. It's a bit frustrating and doesn't really feel good enough given the users generate the content which makes the site so lucrative.

I would encourage people to look into making a GDPR complaint, and screenshot or print a PDF copy of this thread as part of that complaint.

Data security should be taken far more seriously than a proverbial pat on the head and a "sorry you feel sad". Nope - there are actual laws to follow here.

As per our message last night, if we have contacted you on an 'old' email address please do forward the email you received (to contactus@) and we will remove it from our email system asap

Are you saying you have no record of who you contacted? You sent bulk mail out without keeping the logfiles for even a few days?

This doesn't explain either the sending of mails to addresses which have never been registered as contact addresses with MN.