Hacker Read top | best | new | newcomments | leaders | about | bookmarklet login

What’s interesting here is that the data was not collected secretly per se. White Castle used finger prints to unlock computers and access pay stubs, so employees had to know what was going on. The ruling is that they did not ask for and receive consent from those employees for years. The employee in question had been having her finger print scanned since 2004, and they only asked for consent in 2018.

Which begs the question, if they asked and an employee said “no”, what happens? Are they fired? Banned from register work?



sort by: page size:

My question is what would happen to an employee who refused (as I would) to the collection of their fingerprints. If they'd lose their job, that'd mean they were being subject to coercion and consent was not given.

Coercion was never a factor in the law. Even if you wanted your fingerprints taken, you can still sue them for taking it without consent. It is a restriction put into place to enforce a practice.

Another example would be medicine, even if you took medicine knowing possible side effects, the maker of the medicine is still culpable if they don't follow FDA rules.

You can't say consent was implied when the law is telling you a definition of what viable consent is in a specific way. You can't just ignore the law and make excuses or blame the employees. On their part, they only have to prove that fingerprints were taken and consent was not. If you are they can just quit, then the entire point of the law is sl they won't have to and instead punish the company.


The company won’t want to record this info, but requiring them to do so could prevent them from abusing employees using the methods stated above.

>From an OPSEC perspective, sure. But the question was whether it's legal for an employer to do it.

How often did that stop an employer?


From the wiki, coercion is distinguished by things like:

> the intent, the willingness to cause harm, the result of the interaction, and the options available to the coerced party

If the intent is to get people to hand over sensitive data knowingly violating the law and putting people at risk because it makes things easier for the company, I think there's a case to be made that it is coercion. White castle employees aren't exactly known for having a ton of "options available" either. I doubt very many employees have dreamed of working there because of their passion for steamed meats or love for the company. Seems like more of a "when I have zero other options" kind of career move to me.


Which side can't display consent, the employer or the employee?

> Not without notice of the company

Oh? The reports I read were that they could compel an individual to do something and not tell their employer.


Was that employee questioned by the FBI? Did they face further consequences?

You shouldn't be able to get away with something like that.


Aren't there laws against releasing payroll data without the consent of the employee?

> without the knowledge or consent of the employer

Even if that were true (it is not, as far as I can tell), they would know that it will be tracked and could possibly be used against them later. Never make employees choose between a paycheck and following the law.

Well yeah, but at the same time, exfiltrating internal company data is still grounds for dismissal. It could be ethical and the Right Thing to Do, but you still crossed a boundary.

She's lost her job; if she's lucky that's the end of it. She can probably sue to get her job back or a compensation depending on whether a judge or jury rules that leaking the data served a higher purpose, but it's debatable.


The initial claim was that employees were doing something illegal. You can not send employees an email to instruct them to do something illegal.

They could easily fire them as a customer. They shouldn't look at the data though.

Understatement of the year. I am sure there are some places where being caught doing something like that (without authorization) could result in one of those “my hands are tied, I have to fire you” situations.

Think places where security is a big deal, like finance, military, aerospace, critical infrastructure etc.


I'm not sure I see anything illegal in there (from the perspective of PA employment law anyway). His biggest beef seems to be that they mined data without their employee's consent, but most of the places I work explicitly state that emails, chats, electronic and physical documentation (work products) all belong to the organization.

On one hand, this feels a bit scummy - on the other hand, I'd rather work somewhere that's not toxic. I think the biggest issue is that I doubt their technique is good enough to a) find all the toxic people (one of the most toxic people I ever met was outstanding at never putting it in writing) and b) will exclude people that could have improved the company.


I really hope this catches on, because there are places with more modern approaches on paper, but there's no way for the employee to make use of it without consequences.

The bit where their only recourse to a company facing a meaningful punishment for allowing a hostile work environment is to institute an incredibly invasive level of snooping?

That’d be illegal for an employee to do.
next

Legal | privacy