AI “little hands” file complaint for breach of data protection rules

The complaint lodged against Outlier, a crowdsourcing platform operated by the U.S. AI company Scale AI, has ignited fresh scrutiny of how personal data is handled within the burgeoning artificial‑intelligence annotation industry. Five independent labourers – who collectively refer to themselves as “little hands” – and the French workers’ rights group Noyb have alleged that the platform’s data‑collection practices conflict with European data‑protection law, specifically the General Data Protection Regulation (GDPR). The activists claim that the platform’s processes for harvesting and storing employee information exceed what is permissible under current EU regulations.

Outlier is marketed as a marketplace that links businesses seeking large, labelled data sets with a dispersed workforce capable of completing micro‑tasks such as transcribing documents, tagging images, or classifying facial expressions. Workers are typically free‑lance and are paid on a per‑task basis. The “little hands” group argues that while the company provides access to these tasks, it simultaneously collects sensitive personal data – including identification details, work histories and potentially biometric information – without adequate lawful grounds, consent or transparent purposes. They see this as a way for Scale AI to produce a proprietary data catalogue that could be used to train commercial AI models, thereby generating revenue from the very workers that feed the system.

The main legal question hinges on whether Outlier’s data‑processing activities fall under the GDPR’s mandates for lawful bases, data minimisation and purpose limitation. The complainants argue that the company’s collection of data is overly broad and that the platform’s design fails to properly inform workers about how their data will be used, stored or shared with downstream clients. If the claims hold, the platform could be in breach of Article 5 (principles), Article 6 (lawful bases) and Article 7 (conditions for consent) of the GDPR, among other provisions.

The implications extend beyond the immediate parties. A successful ruling could set a precedent for other AI‑annotation platforms that rely on flexible, often international hand‑off models for data labour. European regulators, including the French Commission Nationale de l’Informatique et des Libertés (CNIL), may be prompted to investigate the extent of data‑processing practices across the sector. Even a cautious outcome could force companies to revisit their privacy notices, obtain more explicit worker consents, and invest in robust data‑security protocols.

Scale AI and other U.S. tech firms that operate within Europe have faced similar challenges in the past, and the regulatory climate is tightening. The case therefore signals to the industry that compliance with GDPR is not merely an ethical choice but a commercial necessity. Moreover, the involvement of Noyb – a federation of unions and workers’ associations – underscores the heightened sensitivity around labour rights within the AI ecosystem.

Machine-translated from French