Premium 'Recently Registered' email

[SantasBritchesSpelleas]

I had an email advertising Premium saying 'We noticed you recently registered with Mumsnet'. I registered several years ago! Is this an error or is it like moving into a small village where you're still considered an incomer 20 years later?

Im actually quite shocked that you (MNHQ) have not addressed this properly and are effectively suggesting that people are lying. I am not and I'm sure the others aren't either, why would we.

After the previous data breach I deregistered my account and made this one with a email just for MN as it's clear GDPR and data safety isn't a concern to MNHQ.

The account I received the premium email to was that email address (my main one). It should not be on your system, you have no permission to store my deregistered data, or any data people have removed/changed.

I have submitted a complaint with screen shots of the emails and included a link to this thread. Hopefully it will be resolved that way and you start taking people's data seriously. It's not a "woops sorry, have some festive gin, teeheehee" situation, it's serious and you never seem to learn.

I'm puzzled. When someone changed their email, why didn't you just overwrite the email address on the database?

@Lucylaine We're very keen to investigate this - but we can't without knowing more details. Please could you email us either the address of the old account, or a previous username so we can check what's happened here. Thanks in advance,
MNHQ

Mumsnet Privacy Policy

(extract)

Our aims and duty of care
−
We recognise our duty of care with regards to your data and will always endeavour to do the right thing with the personal data you choose to share with us, including: not compromising your anonymity; protecting your privacy; storing your data securely and giving you control over your own data.

Our mission at Mumsnet is to help make parents’ lives easier. We believe that securing your data, preserving your anonymity, protecting your privacy, and giving you control over your data are an important aspect of that mission.

How long is your data held
−
Any personal data you give us, or that we collect when you use a Mumsnet product, will be retained by us for as long as it’s needed to perform its function. Registration data is held permanently unless you deregister. There’s no one-size-fits-all time limit, but we regularly review the data we hold to ensure it is still necessary. (continues)

We regularly review the data held by Mumsnet’s different teams and delete information that is no longer needed. All the data we hold is stored securely and only accessible to authorised staff members, who have regular data training.

On two previous occasions where Mumsnet members' data was breached, the retaining of previous email addresses was raised.

Many of the claims made in this policy statement are not backed up by the responses by senior Mumsnet staff.

There is another post on the Site Stuff board from someone yesterday night, explaining that they have twice asked MN to delete an email address of theirs and that MN haven't done it. Does MNHQ take data storage and protection seriously, or not? This clearly isn't a one-off.

@MichaelMumsnet can I ask again what “form” I submitted and what exactly was on that “form”?

Could someone from MNHQ please address the questions and concerns here? If not, I'll be joining the list of users putting in an official complaint with the ICO.

@MichaelMumsnet I have submitted a complaint with ICO, they will be looking into it. I've taken advice from my employers data controller, I'm sure you have someone in that role? They have advised not to give anymore personal data to you (even though you already seem to have this), as it clearly isn't safe and to keep the anon account to track this complaint. I'm sure my official GDPR complaint will look into it all for you. Hopefully the user who has repeatedly asked you to remove her email, but you haven't, has done the same.

Maybe follow up on all the others and their questions, as this seems to be a large issue. No response to @Nnkk on their many attempts.

This really is a mess, once again.

To other Mumsnet users, I'm not being difficult or refusing to let them to look into it, it's just gone on for so long. So many data breaches etc and I'm just done with this on all our behalf. Id much rather the ICO look into it than piss around with MNHQ and be told I'm lying/over reacting and whatever else it will be this time. After Jeffrey/their employee breach, I just don't trust them.

@MichaelMumsnet I’m asking again. can you please tell me what form I submitted and what details were on that form.
All I got was a click through to a website that said thank you for submitting the form.

I didn’t submit a form. I clicked a link not to receive marketing emails.

Also. Please can you tell me why I need to click twice once for marketing and once for premium? Premium pushing is surely just marketing and I don’t understand why I need to do it twice.

Hopeful bump @MichaelMumsnet

@Nnkk

Think they are ignoring this in the hope it'll go away like all the other times they have failed to secure user data 🤨

Hi all

@lucylaine - We tested our de-registration process this morning and can confirm it's working. If you are sure you de-registered and still got an email we'd love to investigate it, but would need your email address to do so.

@TinselAngel We are happy to delete email addresses that have previously been changed retrospectively, but we do need the owners of the email addresses to mail in the details of the old account so we know who to remove.

@Nnkk These are one click links that connect to a form that flags that you don't want to receive any more 'general' emails from mn (e.g about upcoming zoomchats). If you opt out of general emails we won't send you any mails - including premium ones. But there are some people who may be interested in general emails about zoomchats and the like who specifically don't want to hear about premium, so we give two options. In terms of the page just giving the message 'thanks for submitting the form' - this is the default landing page from the email service provider, we agree it's not a great customer experience so we'll look into improving this and making it much more user friendly'.

Thank you @soniamumsnet.

The page confused me because I thought it was saying I had filled in a form and I didn’t.

@Nnkk no problem.

We are happy to delete email addresses that have previously been changed retrospectively, but we do need the owners of the email addresses to mail in the details of the old account so we know who to remove.

@soniamumsnet What is the rationale for keeping redundant emails on file? Many women changed their emails in response to the previous data breaches and as I have demonstrated, members were given to believe they already had assurances this data (often identifying) would not be held on your database.

Why are you holding this data, especially when Mumsnet claims to have a duty of care and be aware of women's need for privacy?

@soniamumsnet

Can someone, preferably @JustineMumsnet respond to my questions, please?

What is the rationale for keeping redundant emails on file?

And emails which have never been registered with MN. It feels like a random trawl for addresses has been used to send the advertising.

We are happy to delete email addresses that have previously been changed retrospectively, but we do need the owners of the email addresses to mail in the details of the old account so we know who to remove.

This is back to front. How do we know to request removal without knowing what is held? When I look at my account settings only one email address is shown as registered. There is no indication on that page that previous addresses and even addresses which have never been registered to MN are kept and used.

Why not make all held addresses for the account visible on the account settings? Then have a transparent process for change which states clearly that old addresses will be deleted after X days or which includes a preference option to have old addresses retained or not? These issues with data have been going on for years now and every time its "oh whoopsie silly old us, now go back to your naice gin".

Or do you seriously want every member of MN to raise a SAR to get this basic piece of information?

This is back to front. How do we know to request removal without knowing what is held? When I look at my account settings only one email address is shown as registered. There is no indication on that page that previous addresses and even addresses which have never been registered to MN are kept and used.

Yes this is my issue @soniamumsnet

How would mumsnet have emails attached to a user if those emails were never used to register? Or if someone is unregistered o mumsnet keep a record of email addresses? If so, where do they get them from?

@R0wantrees

We are happy to delete email addresses that have previously been changed retrospectively, but we do need the owners of the email addresses to mail in the details of the old account so we know who to remove.

@soniamumsnet What is the rationale for keeping redundant emails on file? Many women changed their emails in response to the previous data breaches and as I have demonstrated, members were given to believe they already had assurances this data (often identifying) would not be held on your database.

Why are you holding this data, especially when Mumsnet claims to have a duty of care and be aware of women's need for privacy?

Hello,

When a user changes email address, it's deleted from their user account. We do need to keep track of changes made to user accounts to prevent abuse, and the details of any email changes are stored in our database in case someone tries to move someone else's account to a different email address and we then need to investigate.

So when you said you deleted email addresses, that’s not what you meant?

When a user changes email address, it's deleted from their user account. We do need to keep track of changes made to user accounts to prevent abuse, and the details of any email changes are stored in our database in case someone tries to move someone else's account to a different email address and we then need to investigate

So when @Justinemumsnet said nearly two years ago that when someone deregisters all their personal information is removed straight away this wasn't correct?

Audit records, especially where holding personal data which you should not be using other than purely for audit, should not be part of a mailing system nor accessible to it. That is absolutely core data design. Additionally if you are going to cull email addresses not explicitly provided to be the registered email address then you need to be very upfront and clear about this, especially when you use them to send spam to members.

We do need to keep track of changes made to user accounts to prevent abuse, and the details of any email changes are stored in our database in case someone tries to move someone else's account to a different email address and we then need to investigate

Sorry posted too soon. I'm also bemused that at the one hand you keep all this audit data but at the same time you need us to tell you which email addresses you hold for us.

Which is it?

I think I've suggested previously that a decent test architect might save you some of these 'embarrassments' but seems you need a data architect and an ops architect as well to sort out your data management and your apparent failure to log activities using personal data and mail shots.

When a user changes email address, it's deleted from their user account. We do need to keep track of changes made to user accounts to prevent abuse, and the details of any email changes are stored in our database in case someone tries to move someone else's account to a different email address and we then need to investigate.

I'm sorry I don't understand this answer it seems contradictory.

If I have changed my email address can you still link the old one to me, or not?