Data annotator monitoring: what should buyers require of AI vendors?

On 15 October 2026 the research group DiPLab, together with Reversing.Works and Intérêt à Agir, published the report Surveillance at Scale on Outlier, an annotation platform operated by Scale AI. The report was covered by Digi.no on 17 October 2026. It is a research report rather than a decision of a supervisory authority, and its findings of likely GDPR infringements are the authors’ own assessment. We have found no response from Scale AI. This article considers, for Norwegian and Nordic buyers of annotation services, which rules govern the monitoring of annotators, who are frequently engaged as contractors, and what the buyer should require in the vendor agreement.

What does the report say about data annotator monitoring?

The report is based on interviews with 35 annotators in 13 European countries, Norway among them, conducted between 2024 and 2026. Eleven of them shared browser logs showing the third parties to which the platform transmitted data. The authors state that they identified 16 third-party trackers, including social media pixels and analytics tools that record clicks, mouse movements and screen activity. According to the report, annotators must also undergo biometric identity verification with an external provider, involving a scan of an identity document and a video of the face, and the check is repeated when, among other things, the annotator is located in another country. The findings rest on a small sample and on what can be read from browser logs, and no authority has ruled on them.

Which rules apply when the annotator is a contractor?

The GDPR applies in full to the monitoring of annotators, whatever the form of their contract. The processing must comply with the principles of purpose limitation and data minimisation in GDPR Art. 5(1), and it requires a lawful basis. The vendor will normally rely on legitimate interests under GDPR Art. 6(1)(f). Quality control and fraud prevention are legitimate purposes, but advertising trackers and continuous screen recording will rarely be necessary for them. Biometric data processed to identify a person are special category data under GDPR Art. 9(1). Consent from an annotator who depends on the platform for work will seldom be freely given within the meaning of GDPR Art. 4(11) and GDPR Art. 7(4). Systematic monitoring of employees appears on the Norwegian Data Protection Authority’s list of processing operations that always require a DPIA under GDPR Art. 35.

GDPR Art. 88 permits national rules on the processing of personal data in the employment context. In Norway such rules are found in Chapter 9 of the Working Environment Act. Control measures require objective grounds and must not impose a disproportionate burden under aml. § 9-1, and they must be discussed with employee representatives under aml. § 9-2. Under e-postforskriften § 2(2) an employer may not monitor an employee’s use of electronic equipment, save for administering the network and detecting or investigating security breaches. These rules are discussed further in our articles on employee email access and AI policies for employees. They apply only to employees within the meaning of aml. § 1-8, and whether an annotator is an employee is determined by the actual relationship rather than the contractual label. In our view, a vendor that monitors contractors working in Norway in a manner that would be prohibited in respect of employees will nonetheless be in a weak position when balancing interests under the GDPR.

What do the Platform Work Directive and the AI Act add?

The Platform Work Directive (EU) 2024/2831 must be transposed in the EU by 2 December 2026, pursuant to Platform Work Directive Art. 29(1). Its rules on algorithmic management apply to every person performing platform work, including those who are not employees, under Platform Work Directive Art. 1(2). Under Platform Work Directive Art. 7(1) a platform may not, among other things, process data on a person’s emotional state, private conversations or data collected while the person is not working, nor use biometrics to identify the person by comparison with a database. Automated monitoring is high-risk processing under Platform Work Directive Art. 8, and a decision to restrict, suspend or terminate an account must be taken by a human being under Platform Work Directive Art. 10(5). Whether an annotation service is a digital labour platform within Platform Work Directive Art. 2(1)(a) must be assessed concretely. On 21 October 2026 the Directive was listed as under scrutiny for incorporation into the EEA Agreement and does not apply in Norway.

Under AI Act Annex III point 4(b) the AI Act classifies as high-risk those AI systems that allocate tasks on the basis of individual behaviour, or monitor and evaluate performance, in work-related relationships. Recital 57 makes clear that persons providing services through platforms are included. The obligations for such systems apply in the EU from 2 December 2027 following Regulation (EU) 2026/1744. The use of AI to infer emotions in the workplace is prohibited under AI Act Art. 5(1)(f). The Regulation has not yet been incorporated into the EEA Agreement.

Does the buyer of annotation services bear its own liability?

The vendor is normally the controller of the data about its own annotators, while the buyer is the controller of any personal data sent for annotation. The vendor then acts as processor under GDPR Art. 28, as discussed in our article on the SaaS data processing agreement. The risk may nevertheless reach the buyer in three ways. If screen recording or analytics tools capture the content of the annotation interface, the buyer’s data may be transmitted to third parties that have not been authorised as sub-processors under GDPR Art. 28(2), and to countries outside the EEA. If the buyer specifies control measures, or receives and uses data about individual annotators, it may become a controller or a joint controller under GDPR Art. 26, as explained in our article on joint controllership. Larger enterprises within åpenhetsloven § 3 must also carry out due diligence on business partners and the supply chain under åpenhetsloven § 4, and the Transparency Act expressly covers decent working conditions.

What should the buyer require in the vendor agreement?

The requirements below should be included in the master agreement or the data processing agreement with any vendor of annotation, evaluation or human feedback on AI models. They rest on the GDPR and the Transparency Act and anticipate the Platform Work Directive, so that the agreement need not be renegotiated if the Directive enters the EEA Agreement.

1. Require an overview of where the annotators are located, the form of their contracts and any intermediaries and subcontractors involved.
2. Require a complete list of the monitoring, analytics and tracking tools used in respect of annotators, with their purposes and recipients.
3. Prohibit advertising trackers and data sharing with social media in the work interface, and prohibit the capture of the buyer’s data by screen recording or keystroke logging tools.
4. Limit biometric identity verification to what is necessary, and require that annotators be offered an alternative means of verification.
5. Request the vendor’s data protection impact assessment for the monitoring, or a summary of it.
6. Agree that deactivation and withholding of payment are decided by a human being, with reasons and a right of review, in line with Platform Work Directive Art. 10(5) and Platform Work Directive Art. 11.
7. Restrict the data about individual annotators that the buyer receives, so that the buyer does not become a controller without having decided to do so.
8. Include audit rights, a duty to notify incidents and a right to terminate if the monitoring is contrary to the GDPR.

Further articles are available on the data protection topic page. Businesses already using such a vendor should send a written request for the tool list in point 2 and consider the answer in their next due diligence assessment under the Transparency Act.

Questions and answers

Next legal review: 15 January 2027