3 ms·

I knew about the biometric law. I’ve worked in places that collect biometric data. It’s your job to know these things when you do this work. At the very least,

I knew about the biometric law. I’ve worked in places that collect biometric data. It’s your job to know these things when you do this work. At the very least, that law makes an appearance on HN regularly. No law is truly obscure anyways. because they’re all written down for your corporate lawyers to check when you start business. White Castle operates in many states with over 100 years of corporate history. The idea that they couldn’t be bothered to check the laws of all the states they operate in before making changes is not only foolish but if true illustrates a greater sense of recklessness. If you operate in Illinois, you should check the laws in Illinois.

crazygringo 4y ago
But you understand that it's easy to imagine nobody was aware of doing "biometric work", and that it's something corporate lawyers would easily never be alerted to and never become aware of on their own. Like I said, an IT guy decides to install fingerprint access for computer access for franchises nationwide. They're not an expert on biometric security, they just thought it was a good idea. As laws go, this one is not exactly common knowledge. Even corporate lawyers in a state aren't aware of every statute in every area of law -- they have specific areas of expertise. Hiring a biometric security lawyer is not something you do unless you know you have a reason to, if you're just a fast food company. It's not like lawyers review every tiny action by every single employee and contractor. It's easy to see how things like this slip through the cracks.
- vineyardmike 4y ago
  The only excuse they have is the fingerprint scanners were installed before the law. If an IT guy is making a change to accessing payroll that affects 10k employees… it’s corporate lawyer time. I would never touch a payroll system or related (eg time tracking) without labor lawyers at a minimum. This wasn’t a casual IT guy plugging a usb fingerprint sensor into a computer in the break room of a mom and pop sandwich shop. It was across an entire national chain and they were transmitting and storing prints with multiple third parties. They totally had contracts reviewed and lawyers involved already. By now (maybe not in 2008) everyone should know that if you touch personal data or god forbid medical/biometric at all you should get a privacy lawyer review. It’s 2023 and even Facebook asks for consent. At my previous job we’d schedule a lawyer call before started logging new data or updating schemas in a database. Only takes 15 minutes to explain, and a business day for preliminary research on the lawyers part. White Castle started requiring consent in 2018 co-timed to when a major employer in the state was sued for the using fingerprints for payroll. So someone must be paying attention to something, just not soon enough.

crazygringo 4y ago

But you understand that it's easy to imagine nobody was aware of doing "biometric work", and that it's something corporate lawyers would easily never be alerted to and never become aware of on their own. Like I said, an IT guy decides to install fingerprint access for computer access for franchises nationwide. They're not an expert on biometric security, they just thought it was a good idea. As laws go, this one is not exactly common knowledge. Even corporate lawyers in a state aren't aware of every statute in every area of law -- they have specific areas of expertise. Hiring a biometric security lawyer is not something you do unless you know you have a reason to, if you're just a fast food company. It's not like lawyers review every tiny action by every single employee and contractor. It's easy to see how things like this slip through the cracks.

vineyardmike 4y ago
The only excuse they have is the fingerprint scanners were installed before the law. If an IT guy is making a change to accessing payroll that affects 10k employees… it’s corporate lawyer time. I would never touch a payroll system or related (eg time tracking) without labor lawyers at a minimum. This wasn’t a casual IT guy plugging a usb fingerprint sensor into a computer in the break room of a mom and pop sandwich shop. It was across an entire national chain and they were transmitting and storing prints with multiple third parties. They totally had contracts reviewed and lawyers involved already. By now (maybe not in 2008) everyone should know that if you touch personal data or god forbid medical/biometric at all you should get a privacy lawyer review. It’s 2023 and even Facebook asks for consent. At my previous job we’d schedule a lawyer call before started logging new data or updating schemas in a database. Only takes 15 minutes to explain, and a business day for preliminary research on the lawyers part. White Castle started requiring consent in 2018 co-timed to when a major employer in the state was sued for the using fingerprints for payroll. So someone must be paying attention to something, just not soon enough.