美国数据标注公司 Scale AI 因涉嫌非法监控欧洲承包商，在四个欧盟国家面临五起《通用数据保护条例》（GDPR）投诉。隐私倡导组织 noyb 指控 Scale 追踪在其 Outlier AI 平台上从事数据标注工作的承包商。与早年亚马逊 Mechanical Turk 平台上的工人类似，Outlier 承包商负责标注数据、评估 AI 生成的回复，并执行其他任务以改进 AI 模型。Scale 的客户包括 OpenAI、xAI、Anthropic 和 Google 等公司，以及美国政府。
US data annotation operation Scale AI faces five GDPR complaints in four EU countries over allegations that it unlawfully monitors European contractors. Privacy campaigner noyb alleges that Scale tracks contractors who perform data annotation work on its Outlier AI platform. Like workers on Amazon's Mechanical Turk platform of yore, Outlier contractors label data, evaluate AI-generated responses, and perform other tasks to improve AI models. Scale counts companies including OpenAI, xAI, Anthropic, and Google, as well as the US government, among its customers.
自 2018 年欧盟《通用数据保护条例》（GDPR）生效以来，Scale AI 面临的指控与 noyb 对其他美国科技公司提出的指控类似，即违反上述条例。由于所有工作均以数字化、远程方式完成，Scale 拥有大量数据收集做法，不仅用于核实 Outlier 工人的身份，还广泛追踪他们的活动。“平台工作似乎成滋生一种全新型职场监控的温床，”法国隐私研究机构 DIPLab 的社会学研究员 Thomas Le Bonniec 表示，他本月早些时候合著了一份报告，考察 Outlier 的数据收集做法。“在欧盟，任何其他形式的雇佣关系中，这都会被视为不可接受。”
Scale AI faces allegations similar to those noyb has made against other US tech firms since the EU’s General Data Protection Regulation (GDPR) went into effect in 2018, namely violations of said regulation. With all that work being done digitally and remotely, Scale has extensive data collection practices to not only verify the identity of Outlier workers, but also to extensively track their activity. “Platform work seems to be fertile ground for a whole new type of workplace surveillance,” said Thomas Le Bonniec, sociology researcher at French privacy research group DIPLab, who co-authored a report earlier this month examining Outlier's data collection practices. “This would be seen as unacceptable in any other form of employment in the European Union.”
引起 noyb 律师关注的问题之一，是由 Persona 公司进行的身份验证。该公司因与其争取美国政府业务相关的一个暴露的测试环境而受到审查。研究人员推测，该系统可能被用于构建人员追踪器，但 Persona 拒绝这种解读，并否认拥有有效的美国政府合同。此外，在聊天应用 Discord 更大范围推出年龄验证功能前，Persona 与 Discord 的关系恶化，Discord 称该供应商未能满足其设备端面部年龄估算的要求。
Among the issues that raised the hackles of noyb's lawyers was identity verification conducted by Persona, a company that has faced scrutiny over an exposed test environment associated with its efforts to secure US government business. Researchers speculated that the system could be used to build a people tracker, but Persona rejected that interpretation and denied having active US government contracts. Separately, Persona's relationship with chat app Discord soured ahead of the platform's broader age verification rollout, with Discord saying the provider failed to meet its requirements for on-device facial age estimation.
据noyb称，Persona收集生物识别数据以核实Outlier承包商的身份，并收集Outlier用户的IP地址、设备信息、地理位置数据、地址和信用数据。除了生物识别数据外，noyb指控Scale通过收集系统数据和设备活动（包括Outlier工作之外的活动）来追踪Outlier工作者，并将这些数据传输给包括LinkedIn、TikTok、Facebook在内的第三方及其他分析服务，频率高达每几秒一次。
According to noyb, Persona collects biometric data to verify Outlier contractors are who they say they are, as well as gathering IP addresses, device info, geolocation data, addresses, and credit data of Outlier users. In addition to the biometric identification data, noyb accuses Scale of tracking Outlier workers by collecting system data and device activity (including activity outside of Outlier work), and transmitting that to third parties including LinkedIn, TikTok, Facebook, and other analytics services as often as every few seconds.
Noyb警告称，这些信息可能被用于构建个人画像并投放定向广告。“这种工作期间持续且大范围的追踪确实违背了所有合理预期，”noyb数据保护律师Lisa Steinfeld Leiser就这些指控表示。“为什么LinkedIn或Facebook应该知道你在做哪些任务？”Noyb已在法国、意大利、荷兰和奥地利针对Scale提出投诉，理由是其缺乏在承包商设备上安装追踪软件的法律依据。
Noyb warns that the information could be used to profile individuals and serve targeted advertising. “Such constant and extensive tracking while working really goes against all reasonable expectations,” noyb data protection lawyer Lisa Steinfeld Leiser said of the allegations. “Why should LinkedIn or Facebook know which tasks you're working on?”Noyb has filed complaints in France, Italy, the Netherlands, and Austria against Scale, arguing that it lacks a legal basis to install tracking software on contractors’ devices.
这家美国公司还被指控违反GDPR的数据最小化原则，该原则要求公司仅收集为特定目的严格必要的数据。投诉还主张，Scale无视投诉人要求访问其存储的数据记录的请求，侵犯了GDPR赋予的数据访问权，以及投诉提交国的特定法律。Noyb要求这些国家的数据保护机构进行全面调查，并在必要时因涉嫌违规对Scale处以罚款。
The US company also stands accused of violating GDPR rules on data minimization, which requires that companies only collect data that’s strictly necessary for specific purposes. The complaints also assert Scale violated GDPR rights to data access after ignoring complainants’ requests to access the records of what data Scale had stored on them, as well as country-specific laws in the nations where the complaints were filed. Noyb is asking data protection authorities in those nations to conduct a full investigation and, if necessary, fine Scale for its alleged violations.
“报告的指控毫无根据且不准确，”Scale在本文首次发布后向我们表示。“Outlier的做法已向贡献者披露并需要他们的同意。”
""The report’s claims are unfounded and inaccurate," Scale told us after this article was first published. "Outlier’s practices are disclosed to contributors and require their consent.
“我们使用标准工具来验证身份、防止欺诈、保护机密项目信息，并确保付款准确无误。”这起诉讼很可能会进一步助长正在欧盟蔓延的数字主权运动，欧盟在过去几年开始意识到，完全依赖美国科技公司可能并不符合该集团的最佳利益，即使这种分离可能极其痛苦。 ® 于 1730 UTC 更新，加入了 Scale 的评论。
We use standard tools to verify identities, prevent fraud, protect confidential project information, and ensure accurate payment." The complaint is likely to give further fuel to the digital sovereignty movement sweeping the EU, which has begun to realize in the past couple of years that it may not be in the best interest of the bloc to be entirely beholden to US tech companies, even if such a separation may be painfully difficult. ® Updated at 1730 UTC to include comment from Scale.