Food delivery company DoorDash filed a lawsuit Wednesday against New York City over a new data-sharing law that it says will endanger their customers’ personal data. The new law was passed by the city council on Aug. 29 over the protests of DoorDash and local chambers of commerce that are concerned about the law’s effects on their business.

Under the new law, DoorDash and other food delivery apps like GrubHub are required to share data with restaurants they work with on their customers. This data includes information such as name, phone number, e-mail address, delivery address and the contents of their orders, and the restaurants would be allowed to retain this information. The delivery service apps would be forbidden from dictating limits to the restaurants they work with on how this data can be used.

In its lawsuit, DoorDash said it was “left with no choice” but to pursue this issue in the courts after efforts to persuade the council to take business and privacy advocates' concerns seriously failed. The company warns that the customer data it receives is at risk of being compromised because the bill does not mandate restaurants implement data-security requirements once they receive a customer's information. This, it argues, will undermine its position of trust with customers.

“The City Council’s legislation, N.Y.C. Int. No. 2311-A, would not only destroy that trust by forcing delivery platforms to disclose sensitive, personal customer data to restaurants without any protections for that data, but would also open the door for sensitive information like names, email addresses, home addresses, and telephone numbers to be misused, spammed, and available without any protection because of how poorly the bill was drafted,” DoorDash said in a press statement announcing the lawsuit.

Going further, DoorDash warns that data-vulnerable communities, including people of color and LGBT customers, would be directly endangered. DoorDash was joined in opposition against the council’s law by the National Gay and Lesbian Chamber of Commerce, Haitian American Caucus and the New York Hispanic Chamber of Commerce among others for this reason.

Under the local law, DoorDash and delivery service providers may not be able to mandate limits on restaurants’ use of customer data, but it prohibits the establishments from selling, renting or disclosing the information without express consent from the customer. The customer would also be allowed to withdraw their consent to using their information and to request that their information be deleted.

DoorDash’s lawsuit over the data-security law is the second against New York City in recent months. Joined by GrubHub and UberEats, the trio sued the city after another law was passed that capped the fees they can charge restaurants for delivery, advertising and credit card processing. DoorDash slammed the measure as “unnecessary and unconstitutional.”

Mayor Bill de Blasio now has 30 days to sign the bill into law and if he does, the bill would go into effect after 120 days.

RELATED STORIES