A bankruptcy sale that treats data as an asset

Google has emerged as the successful bidder for a large archive of internal data from the defunct US carrier Spirit Airlines, offering $10 million in an August 14 bankruptcy auction. The proposed transaction remains subject to court approval; a hearing that had been scheduled for August 19 was postponed to September 9 after the Association of Flight Attendants-CWA (AFA) objected.

The immediate dispute is not about customer travel histories. Spirit and Google say customer information and personally identifiable information will not be included in the final dataset. Instead, the controversy centres on the scale and nature of workplace material due to be transferred after a deidentification process, and on whether removing direct identifiers sufficiently protects former employees.

For Google, the material could assist product development and AI-model training. For former cabin crew, it raises a broader security and privacy question: when a company collapses, can decades of employment records, communications and operational traces be sold for a new purpose that workers never anticipated?

What the proposed sale includes

The AFA’s bankruptcy-court filing describes a dataset that extends well beyond conventional airline operational data. It includes productivity and collaboration material, human-resources and legacy-operations data, as well as workflow and process records.

The filing lists approximately 1.09 million time-card entries, 175,658 employee records, more than 3.4 million payroll records and 148,018 employee tax forms. It also identifies corporate and crew-training records, applicant-tracking material, employment contracts, litigation files, business-travel records, crew-base information and more than five million crew-pairing records.

The unstructured material is particularly significant. According to the union, the assets include around 100 million emails across 80,000 accounts, 17.1 million OneDrive items, 20.6 million SharePoint items and 500 million Microsoft Teams items. Such repositories can contain operational know-how that is valuable for analysing how an airline functioned. They can also contain sensitive details that are difficult to classify reliably at scale, including leave requests, health-related communications, disciplinary matters, pay adjustments, grievances and union discussions.

That distinction explains why this is a security story as much as an AI story. The risk is not confined to an obvious field such as a name, email address or telephone number. A document can remain confidential even if those identifiers have been removed.

Deidentification is not the same as confidentiality

The sale agreement’s central protection is deidentification. The buyer is to receive data processed to remove or transform information that could be associated with a consumer or household. Google has also said it will not receive personal information, and that it will not intentionally re-associate deidentified data with a person.

Those commitments matter, but they do not settle the union’s objection. The AFA argues that the proposed safeguards were built around consumer privacy law, while the most extensive material in the transaction concerns employees. In its filing, the union notes that many customer-facing categories are excluded, while employee, payroll, training and workplace-document categories are included.

The union’s more technical concern is that the agreement requires deidentification while preserving “referential integrity” across the dataset. In practical terms, that means retaining useful relationships among records from different systems. Those links may be important if the buyer wants to understand real-world workflows, but they can also make a dataset more revealing.

A structured and relatively small workforce can be identifiable through combinations of location, role, shift patterns, training events, operational assignments and communications context, even where direct identifiers have been removed. The AFA does not assert that any specific former worker will be reidentified. Its argument is that records involving small groups or distinctive circumstances may still disclose sensitive information, or enable inferences about identifiable people, if linked data is retained.

This is a familiar limitation of privacy engineering. Removing names is often necessary, but it is not always sufficient. Risk depends on the granularity of the remaining data, the availability of outside information, the connections preserved within the dataset and the ability to draw conclusions from the material.

Why free-form communications are difficult to protect

Emails, chat messages and cloud-storage files pose a different challenge from database fields. A payroll table can be screened for direct identifiers. Free-form communications may include a mix of business operations, personal disclosures, employment disputes and attachments in the same file.

The AFA argues that the proposed process does not require a dedicated review, segregation or removal programme for confidential employee and labour-related content. It has asked the court either to exclude flight-attendant information entirely or, at minimum, impose stronger conditions.

Those requested conditions include safeguards for personnel, payroll, tax, disciplinary, investigatory, medical, leave, accommodation, training and union-related material. The union also wants restrictions preventing the buyer from using the data to analyse, profile, evaluate or score an individual flight attendant or an identifiable subgroup. It seeks written controls for onward transfers to third parties and notice of categories of employee-related data that are transferred.

The request is notable because it does not seek to unwind the auction or prevent Spirit’s estate from selling data assets altogether. Rather, it argues that the sale can proceed only after its treatment of workers’ information is brought closer to the protection offered to customers.

A decision with implications beyond one airline

The September 9 hearing will determine the next step for this specific sale, not the wider rules for AI training data. Still, the dispute exposes an increasingly important gap in corporate data governance.

Employees generally understand that company systems are not private in the same way as personal accounts. Yet that expectation does not necessarily mean workers expect an employer’s historical communications archive to be transferred to a technology company after liquidation, then used to improve AI products. The purpose change is central: records originally generated for employment administration and airline operations may become training or product-development inputs years later.

Bankruptcy law has established mechanisms focused on the sale of consumers’ personally identifiable information. The Spirit dispute illustrates that worker data may fall outside the clearest version of those protections even when it is equally sensitive in substance. It also shows why a narrow definition of personal information can leave unresolved questions about confidential content, inference risks and future data sharing.

For companies, the practical lesson is that retention and access policies should be designed with eventual transfer scenarios in mind, not solely with day-to-day operations or breach prevention in view. For regulators and labour organisations, the case may sharpen calls for rules that address employee data separately from consumer data.

The proposed sale has not closed, and no data has yet been transferred to Google. But the court’s eventual conditions will be closely watched because they may help establish what privacy protections are expected when a bankrupt employer’s information becomes valuable training material for AI.

Sources