Washington v. Persona biometric privacy lawsuit

Two DoorDash drivers sued Persona Identities in late 2021, alleging it wrongfully possessed & profited from their biometric information without publicly disclosing its retention & destruction policy. DoorDash's registration process required them to submit live selfies & photographs of their driver's license cards. According to the appellate court, DoorDash authenticated drivers with Persona's identity verification software, which collects, analyzes, and stores scans of the drivers’ facial geometries. Persona, which the court said is not a party to the Agreement the drivers accepted from DoorDash, moved in September 2023 to compel individual arbitration of their claims under that contract. The Circuit Court of Will County granted the motion in February 2024. On August 13, 2024, the Appellate Court of Illinois, Third District, reversed, holding that Persona has no legitimate basis to compel plaintiffs’ claims to arbitration. The Illinois Supreme Court denied Persona's petition for leave to appeal on November 27, 2024.

Drivers' biometric privacy claims against Persona

Charles Washington & Katie Sims registered to become delivery drivers for DoorDash in 2021. They sued Persona Identities, Inc., which the appellate court described as a software company that provides businesses automated identity verification services, under the Biometric Information Privacy Act (740 ILCS 14/1 et seq.). The case was filed in the Circuit Court of Will County as No. 21-L-816, & the plaintiffs amended their complaint twice.

The second amended complaint seeks injunctive relief & statutory damages. As quoted in the appellate opinion, it proposes a class of:

Illinois residents whose biometric identifiers or biometric information were possessed by [Persona] at any time within the applicable limitation period.

According to the appellate court's summary, the complaint alleges Persona did not publicly disclose its biometric retention & destruction policy upon collecting that information.

Among its other provisions, Illinois' Biometric Information Privacy Act, codified at 740 ILCS 14, requires a private entity in possession of biometric identifiers or biometric information to:

develop a written policy, made available to the public, establishing a retention schedule and guidelines for permanently destroying biometric identifiers and biometric information ...

Section 15(c) provides that no private entity in possession of such data may sell, lease, trade, or otherwise profit from a person's biometric identifier or biometric information. Section 20 gives any person aggrieved by a violation a right of action in a state circuit court or, as a supplemental claim, in federal district court, with liquidated damages of $1,000 per negligent violation or $5,000 per intentional or reckless violation, or actual damages if greater. Under Section 20's current text, which cites Public Act 103-769 (effective August 2, 2024) as its source, a private entity that, in more than one instance, obtains the same biometric identifier or biometric information from the same person using the same method of collection in violation of Section 15(b) has committed a single violation of that subsection.

Background

According to the August 2024 opinion, DoorDash occasionally prompted its drivers after registration to reverify their identities by submitting selfies on its mobile application. On August 14, 2023, DoorDash announced identity re-verification for drivers in the United States, requiring a selfie that matches the driver's government ID & naming Our third-party vendor, Persona as the company that verifies it. DoorDash wrote that if a driver's identity cannot be verified, the Dasher account will be suspended and they will no longer be allowed to dash.

On December 12, 2024, DoorDash said it would require more than 150,000 drivers to re-verify their identity each week. The same post said DoorDash had begun requiring select drivers to occasionally complete a real-time identity check during a dash, immediately after they complete a delivery. DoorDash wrote in the post:

If someone can’t or won’t re-verify their identity, they will not be allowed to continue dashing.

Biometric Update reported that drivers complete these checks with Persona's 1:1 selfie biometrics system, which matches a selfie to the face on a government ID.

DoorDash's help center FAQ on driver identity verification states:

Your information, including your biometric data, will be stored by DoorDash or its vendors such as Persona for purposes of identity verification. Your data will be permanently deleted after it is no longer necessary.

Persona's motion to compel arbitration

When they registered, Washington & Sims also accepted DoorDash's Independent Contractor Agreement. Its Mutual Arbitration Provision is governed by the Federal Arbitration Act & applies to any and all disputes arising out of or relating to this Agreement. The provision states that arbitration is not a mandatory condition of a driver's relationship with DoorDash & lets a driver opt out by submitting a statement to DoorDash. A separate clause of the Agreement reads:

In order to perform any Contracted Services, CONTRACTOR must, for the safety of consumers on the DOORDASH platform, pass a background check administered by a third-party vendor, subject to CONTRACTOR’s lawful consent.

In September 2023, Persona moved to stay the claims under section 3 of the Federal Arbitration Act (9 U.S.C. § 3) & to compel individual arbitration under section 4, asserting third-party beneficiary status under the Agreement. Persona attached a declaration from DoorDash that the plaintiffs had not opted out of the arbitration provision. The plaintiffs responded that Persona had provided no evidence of its involvement in DoorDash's background check process, & noted that DoorDash's website identifies Checkr as the entity performing background checks for DoorDash.

The Will County circuit court, with Judge Barbara N. Petrungaro presiding, granted Persona's motion in February 2024. The appellate opinion quotes the circuit court's explanation:

In this case, Plaintiffs’ identities are verified using Persona’s [software] to aid in the process of the background check. As such, [Persona] is part of the background check process and thus, an intended third-party beneficiary to the Agreement.

Appellate reversal in August 2024

The plaintiffs appealed under Illinois Supreme Court Rule 307(a)(1). The appellate court heard oral argument in No. 3-24-0210 on July 17, 2024. Justice Davenport delivered the judgment of the court with opinion, filed August 13, 2024; Justices Hettel & Albrecht concurred in the judgment & opinion. McGuire Law, P.C., of Chicago represented the plaintiffs on appeal. Baker & Hostetler LLP, of Chicago, represented Persona. The opinion is cited as 2024 IL App (3d) 240210 and reported at 254 N.E.3d 394.

Federal Arbitration Act jurisdiction argument

Persona asked the court to dismiss the appeal for lack of jurisdiction, arguing that section 16(b) of the Federal Arbitration Act preempts Rule 307(a). The court held that Section 16(b) of the FAA does not supersede Rule 307(a)(1). It also wrote that only parties to a contract may invoke its choice-of-law provision, & that a nonparty's right to enforce an arbitration agreement is governed by state law, not by the FAA.

Third-party beneficiary claim

Persona argued that it clearly falls under the identified class of third-party vendors included in DoorDash’s Agreement, because, as the court summarized Persona's argument, its identity verification service is a logical first step in the background check process. The court wrote that the arbitration provision encompasses an almost limitless range of arbitrable dispute topics yet is silent about nonparties. It cited for comparison Kashkeesh v. Microsoft Corp., 679 F. Supp. 3d 731 (N.D. Ill. 2023), where a facial recognition software provider was a third-party beneficiary of Uber driver contracts in which drivers agreed to arbitrate disputes with any other entity. The opinion continues:

Unless a nonparty is expressly named or its class described, a generic arbitration clause, no matter how broad, cannot show an intent to directly benefit the nonparty.

The court found that the background check clause does little more than confer an incidental benefit on “a third-party vendor.” That clause, it wrote, does not identify the third-party vendor as an intended beneficiary. Even presuming the Agreement benefits a third-party vendor, the court wrote, Persona must prove it is that vendor, & Persona pointed to no evidence that it administers background checks. Persona also did not contest the plaintiffs' evidence suggesting that DoorDash distinguishes background checks, administered by Checkr, from identity verification automated by Persona's software interface. The court added:

Notably, Persona secured from DoorDash a declaration addressing whether plaintiffs opted out of the arbitration provision, yet it failed to secure a declaration addressing the identity of DoorDash’s third-party vendor. The conclusion that Persona administers background checks is simply unsubstantiated.

In a footnote, the court wrote that Persona's brief at one point seemingly concedes that a background check is distinct from identity verification.

The circuit court had found only that Persona's software aids in the background check process, & the Third District wrote that to “aid” is not to “administer.” It described Persona's role as limited to providing a software interface that automates identity verification, & called that role a far cry from managing or supervising the execution, use, or conduct of the background checks. The court concluded that Persona may not assert intended third-party beneficiary status & that the circuit court erroneously granted Persona’s motion to stay claims and compel arbitration. It reversed the Will County order & remanded the case for further proceedings.

Illinois Supreme Court denial

Persona petitioned the Supreme Court of Illinois for leave to appeal the Third District's decision in case 3-24-0210, under Supreme Court No. 131059. The court's leave to appeal docket for November 27, 2024 records the disposition as Petition for Leave to Appeal Denied.

See also

• Coffee Meets Bagel biometric data collection
• Age verification