|
Raymor, I would think that if you haven't already spent some time with a lawyer, I think you really should. Your collection of info RELATED TO and with the intent of indentifying a single user is VERY borderline. You need a lawyer that is not only up to date on US privacy laws, but those of Canada, Europe, and Asia.
In effect, your system has recorded a "machine set" for an individual user, and you decline access from machines that don't match that "machine set". (machine set being timeclock, extensions supported, browser, version, java enabled, and so on). Somewhere for each installation there is a list of users and a hash of their machine set.
I really do recommend a few moments with a lawyer, your potential liability right now is VERY high.
Alex
|