CPW previously covered a district court’s refusal to compel arbitration for litigation brought against a biometric software developer under Illinois Biometric Information Privacy Act (“BIPA”), finding that the relevant arbitration agreement did not cover the defendant.  Sosa v. Onfido, Inc., 2021 U.S. Dist. LEXIS 658 (N.D. Ill.).  Yesterday the Seventh Circuit affirmed the  ruling, agreeing with the district court “in all respects.”  Sosa v. Onfido, Inc., 2021 U.S. App. LEXIS 23816 (7th Cir. Aug. 11, 2021).  Read on to learn more and what it means going forward.

As readers will recall, the plaintiff in Sosa had an account with Offerup, Inc., a marketplace where people buy and sell goods online.  According to the pleadings, OfferUp partnered with the defendant, Onfido, to establish users’ identities.  Specially, the plaintiff alleged that users (including himself) upload their driver’s license or ID along with photos of their faces, and that Onfido’s software scans the images and extracts biometric identifiers in order to confirm if they match the uploaded IDs.  The plaintiff filed a putative class action complaint, alleging that Onfido violated BIPA by allegedly collecting and storing biometric information without obtaining written releases and providing certain required notices.

Onfido invoked the arbitration provision in OfferUp’s Terms of Service, which Onfido claimed the plaintiff agreed to when he registered for OfferUp and each time he accessed his account. Ordinarily, as a matter of Illinois law, only signatories to an arbitration agreement can enforce it, but Onfido argued that three court-recognized exceptions to this rule applied: (1) third-party beneficiary, (2) equitable estoppel, and (3) agency.

The district court rejected each of Onfido’s nonparty contract enforcement theories and denied Onfido’s motion to compel individual arbitration.  Among other findings, the district court held that Onfido “failed to establish that it was a third-party beneficiary of the Terms of Service or that it could otherwise enforce the contract’s arbitration provision either as an agent of OfferUp or on equitable estoppel grounds.”

An appeal to the Seventh Circuit followed.

Assessing the district court’s refusal to compel arbitration de novo, the Seventh Circuit noted that Illinois courts recognize a “strong presumption against conferring contractual benefits on noncontracting third parties” and “[t]o overcome that presumption, ‘the implication that the contract applies to third parties must be so strong as to be practically an express declaration.’” (emphasis supplied) (quotation omitted).  Here, Onfido was not named in the Terms of Service nor did any other provision establish its status as a third-party beneficiary.  To the contrary, the Seventh Circuit held, the Terms of Service explicitly state “that the contract creates no ‘private right of action on the part of any third party.’”

Nor did any of Onfido’s other arguments pass muster.  First, Onfido’s agency theory supporting arbitration failed as the Seventh Circuit ruled “that OfferUp encouraged users to register their identities with the app’s TruYou feature and that Onfido and OfferUp partnered to provide this technology through the app establishes nothing more than a business relationship between the parties—not agency.” (emphasis supplied).  Second, nor did the Seventh Circuit find any equitable considerations supporting adoption of Onfido’s position.

This ruling confirms that plaintiff’s BIPA claims against this ID-verifying software developer will be resolved in federal court, not arbitration.  The case also offers a cautionary note that while an arbitration agreement can defeat a data privacy litigation, such provisions must be carefully drafted to cover anticipated claims and disputes.