3 ms·

This isnt about fingerprints. This is about a large corporation not reading a law. This is about recklessly adopting a new business practice without first con

This isnt about fingerprints. This is about a large corporation not reading a law. This is about recklessly adopting a new business practice without first consulting basic legal advice. The big numbers will get knocked down eventually but they are going to be rightfully on the hook for millions.

kderbyma 4y ago
They should. Big business means you front the costs to do proper business. if you make billions and cannot do your legals....too bad. that money will be theirs soon
- crazygringo 4y ago
  White Castle doesn't make "billions". It's annual profit is in the very low millions. It doesn't even take a billion in revenue a year. White Castle isn't Google or Facebook. It's a relatively minor burger chain.
crazygringo 4y ago
Honestly it's pretty easy to see this fall through the cracks. Because it's one of 50 sets of state law, and it's entirely non-obvious that there would be a law around fingerprint readers in the workplace at all. The IT person who decided to adopt it would have needed it to occur to them to check with legal. And I can imagine that for most people it wouldn't occur to them. Any more than you'd think to check with legal about whether a password should require at least one punctuation character. I'm not defending White Castle here but neither do I think it's anywhere close to "reckless". I think it was just a normal day to day IT decision that nobody thought anything of. In other words, there was probably no criminal intent here nor recklessness. Just ignorance of a relatively unknown statute, that sure you should pay a reasonable fine for. Not a big deal.
- sandworm101 4y ago
  Well, if it met the legal definition for recklessness then the leadership would be sued by the shareholders. That isn't this. This is reckless as in not-smart rather than per se. They will have to pay a price so that lawyers for a thousand other companies can walk into the next board meeting to say "See, I told you and I was right about that fingerprint thing last year!" They will be punished, but the courts will not allow this to destroy the company.
- vineyardmike 4y ago
  I knew about the biometric law. I’ve worked in places that collect biometric data. It’s your job to know these things when you do this work. At the very least, that law makes an appearance on HN regularly. No law is truly obscure anyways. because they’re all written down for your corporate lawyers to check when you start business. White Castle operates in many states with over 100 years of corporate history. The idea that they couldn’t be bothered to check the laws of all the states they operate in before making changes is not only foolish but if true illustrates a greater sense of recklessness. If you operate in Illinois, you should check the laws in Illinois.
  - crazygringo 4y ago
    But you understand that it's easy to imagine nobody was aware of doing "biometric work", and that it's something corporate lawyers would easily never be alerted to and never become aware of on their own. Like I said, an IT guy decides to install fingerprint access for computer access for franchises nationwide. They're not an expert on biometric security, they just thought it was a good idea. As laws go, this one is not exactly common knowledge. Even corporate lawyers in a state aren't aware of every statute in every area of law -- they have specific areas of expertise. Hiring a biometric security lawyer is not something you do unless you know you have a reason to, if you're just a fast food company. It's not like lawyers review every tiny action by every single employee and contractor. It's easy to see how things like this slip through the cracks.
    - vineyardmike 4y ago
      The only excuse they have is the fingerprint scanners were installed before the law. If an IT guy is making a change to accessing payroll that affects 10k employees… it’s corporate lawyer time. I would never touch a payroll system or related (eg time tracking) without labor lawyers at a minimum. This wasn’t a casual IT guy plugging a usb fingerprint sensor into a computer in the break room of a mom and pop sandwich shop. It was across an entire national chain and they were transmitting and storing prints with multiple third parties. They totally had contracts reviewed and lawyers involved already. By now (maybe not in 2008) everyone should know that if you touch personal data or god forbid medical/biometric at all you should get a privacy lawyer review. It’s 2023 and even Facebook asks for consent. At my previous job we’d schedule a lawyer call before started logging new data or updating schemas in a database. Only takes 15 minutes to explain, and a business day for preliminary research on the lawyers part. White Castle started requiring consent in 2018 co-timed to when a major employer in the state was sued for the using fingerprints for payroll. So someone must be paying attention to something, just not soon enough.

kderbyma 4y ago

They should. Big business means you front the costs to do proper business. if you make billions and cannot do your legals....too bad. that money will be theirs soon

crazygringo 4y ago
White Castle doesn't make "billions". It's annual profit is in the very low millions. It doesn't even take a billion in revenue a year. White Castle isn't Google or Facebook. It's a relatively minor burger chain.

crazygringo 4y ago

Honestly it's pretty easy to see this fall through the cracks. Because it's one of 50 sets of state law, and it's entirely non-obvious that there would be a law around fingerprint readers in the workplace at all. The IT person who decided to adopt it would have needed it to occur to them to check with legal. And I can imagine that for most people it wouldn't occur to them. Any more than you'd think to check with legal about whether a password should require at least one punctuation character. I'm not defending White Castle here but neither do I think it's anywhere close to "reckless". I think it was just a normal day to day IT decision that nobody thought anything of. In other words, there was probably no criminal intent here nor recklessness. Just ignorance of a relatively unknown statute, that sure you should pay a reasonable fine for. Not a big deal.

sandworm101 4y ago
Well, if it met the legal definition for recklessness then the leadership would be sued by the shareholders. That isn't this. This is reckless as in not-smart rather than per se. They will have to pay a price so that lawyers for a thousand other companies can walk into the next board meeting to say "See, I told you and I was right about that fingerprint thing last year!" They will be punished, but the courts will not allow this to destroy the company.
vineyardmike 4y ago
I knew about the biometric law. I’ve worked in places that collect biometric data. It’s your job to know these things when you do this work. At the very least, that law makes an appearance on HN regularly. No law is truly obscure anyways. because they’re all written down for your corporate lawyers to check when you start business. White Castle operates in many states with over 100 years of corporate history. The idea that they couldn’t be bothered to check the laws of all the states they operate in before making changes is not only foolish but if true illustrates a greater sense of recklessness. If you operate in Illinois, you should check the laws in Illinois.
- crazygringo 4y ago
  But you understand that it's easy to imagine nobody was aware of doing "biometric work", and that it's something corporate lawyers would easily never be alerted to and never become aware of on their own. Like I said, an IT guy decides to install fingerprint access for computer access for franchises nationwide. They're not an expert on biometric security, they just thought it was a good idea. As laws go, this one is not exactly common knowledge. Even corporate lawyers in a state aren't aware of every statute in every area of law -- they have specific areas of expertise. Hiring a biometric security lawyer is not something you do unless you know you have a reason to, if you're just a fast food company. It's not like lawyers review every tiny action by every single employee and contractor. It's easy to see how things like this slip through the cracks.
  - vineyardmike 4y ago
    The only excuse they have is the fingerprint scanners were installed before the law. If an IT guy is making a change to accessing payroll that affects 10k employees… it’s corporate lawyer time. I would never touch a payroll system or related (eg time tracking) without labor lawyers at a minimum. This wasn’t a casual IT guy plugging a usb fingerprint sensor into a computer in the break room of a mom and pop sandwich shop. It was across an entire national chain and they were transmitting and storing prints with multiple third parties. They totally had contracts reviewed and lawyers involved already. By now (maybe not in 2008) everyone should know that if you touch personal data or god forbid medical/biometric at all you should get a privacy lawyer review. It’s 2023 and even Facebook asks for consent. At my previous job we’d schedule a lawyer call before started logging new data or updating schemas in a database. Only takes 15 minutes to explain, and a business day for preliminary research on the lawyers part. White Castle started requiring consent in 2018 co-timed to when a major employer in the state was sued for the using fingerprints for payroll. So someone must be paying attention to something, just not soon enough.