Premium 'Recently Registered' email

[SantasBritchesSpelleas]

I had an email advertising Premium saying 'We noticed you recently registered with Mumsnet'. I registered several years ago! Is this an error or is it like moving into a small village where you're still considered an incomer 20 years later?

We get that the reasoning behind keeping an email address on an Unsubscribed list, when someone has asked for it to be changed or removed, might sound a bit mad, but it’s what the ICO strongly recommends. They say ‘As soon as someone objects to or opts out of your marketing, you should add them to a ‘do not contact’ list. You should screen all your marketing against this list to make sure you don’t contact anyone who has opted out… You must not simply delete their details altogether, as you need to ensure they are not later put back on your marketing list by mistake.’

Keeping an Unsubscribed list is a failsafe mechanism to ensure that those email addresses are never mistakenly re-added or contacted. (We did not send the Christmas Eve email to our Unsubscribed list, for example, because our email provider simply will not allow any emails to go to those addresses.)

As we said upthread, we completely agree that those who've asked for their emails to be changed shouldn't have their old email retained anywhere in the active mailing list in our email provider. That's what the mails we sent aimed to rectify. If you think that applies to you, you can respond to that email by hitting Unsubscribe (which will move you to our Unsubscribe list). However, if you're absolutely sure you want to be manually removed from our Unsubscribed list too, email us on [email protected] and we'll action it for you.

All that said, we are looking at auto-deleting these 'old' emails from the Unsubscribe list at a certain point in time - our email provider suggests 18 months after they are added.

Two things to note, finally:

None of these 'old' emails can in any way be linked to any Mumsnet user account - there is absolutely nothing in our email provider database giving any information about which Mumsnet user account they were previously associated with.

And secondly, we will always hold an email address for anyone who has a Mumsnet user account. This is held in our user database (which is separate from our email provider) and is a part of your log-in information. There's no way to have a Mumsnet user account without your email address being in our user database. That address is used for sending notifications (for example if you have asked to Watch a thread), for responding to you if you ever hit the 'report' button, and, very occasionally, to send urgent emails to every user - for example if we need to force a password reset.

You're damn right you're making us jump through hoops.

I changed my email address linked to my account, because your track record with data security is sketchy to say the least.
At that point, my previous email should have been completely removed from your system. It wasn't.
I then get an email by mistake alerting me to your breach.
I then get another email with the option to "unsubscribe" from mailing lists.
By doing that, my email which should have been completely removed from your system a long time ago simply gets transferred to another list and you are still storing the data which I had previously asked to be removed.

What kind of system are you using? I wouldn't be surprised if it's a few excel spreadsheets from the sound of it. Instead of me emailing you and once again giving you the email address that I decided I didn't want you to have and asked you to remove, I think you should set someone the task of cross-referencing all your email lists, including your do not contact one, with email addresses that are currently linked to user accounts and delete the emails you are storing that are not linked to user accounts. Even if you are using excel, that's a fairly simple, if mind-numbingly boring task.

As we said upthread, we completely agree that those who've asked for their emails to be changed shouldn't have their old email retained anywhere in the active mailing list in our email provider. That's what the mails we sent aimed to rectify.

Those who asked for their emails to be changed should have had their old emails removed completely, not just from the "active" mailing list. The mails you sent did not aim to rectify this as you stated the emails you sent would result in emails being added to the "do not contact" list. So, still retained, not removed as they should have been.

"‘As soon as someone objects to or opts out of your marketing, you should add them to a ‘do not contact’ list. You should screen all your marketing against this list to make sure you don’t contact anyone who has opted out… You must not simply delete their details altogether, as you need to ensure they are not later put back on your marketing list by mistake.’ "

Again, you are still conflating marketing with retaining data. Two different things. When someone says "please delete my data" they are not saying "please keep my data but ensure you don't send me marketing emails".

It's been well established that the security of data has been compromised at MN in the past & you have been given detailed reasons why people deleted emails, accounts, changed emails etc. for reasons of concern over privacy.

I can only repeat that you have no justifiable reason to retain emails anywhere on your systems where people changed their emails (due to concerns over your ability to keep identifying information secure) when they should have been deleted at the time, but weren't because you system failed to do so. Having a list of emails you only have due to a system error is a list that should be deleted without any further delay.

You have to have a justifiable reason to retain & process data - marketing opt out doesn't apply here. So your excuse as to why you haven't just deleted this 'list' doesn't stand up.

This is utterly bonkers @MNHQ

Your database of opted-out users is fine for those who remain users but don't want marketing emails. You need to delete emails of those who deregister or change contact details though. What on earth makes you think its OK to keep a database of those contact details? What justifiable purpose does that serve?