When Spirit Airlines stopped flying in May, its planes, slots and gates were not the only assets left to sell. Its internal email, chat logs, calendars and operational records went up for auction too, and Google won with a $10 million bid to use the material for AI development. On November 10, a coalition of airline unions withdrew its objections to that sale after Spirit, Google and the unions agreed to drop more categories of employee data and tighten the de-identification process. The settlement clears a path to court approval, but it also exposes a gap that every company holding workforce data should understand: the Bankruptcy Code’s privacy safeguards were written for consumers, not employees.
TL;DR
- Airline unions withdrew their objections to the $10 million sale of Spirit Airlines’ de-identified business data to Google after the parties agreed to exclude about 20 categories of employee records, including medical, drug-testing, disciplinary and payroll data.
- The remaining data must be de-identified under the ISO/IEC 27559 framework, checked by an independent verification agent chosen in consultation with the unions, and Google may not try to re-identify it.
- A court-appointed consumer privacy ombudsman had already recommended approval in October after passenger databases covering about 97 million customers were removed, but her review expressly did not cover risks to employees.
What is actually being sold
Early coverage described the deal as Google “buying Spirit’s employee data.” The court record is more specific, and the difference matters. In the Chapter 11 case, In re Spirit Aviation Holdings (Bankr. S.D.N.Y., No. 25-11897), the debtors offered what they call deidentified enterprise data: productivity and collaboration material such as email, calendars, document repositories and chat messages; core business systems covering customer behavior, employee productivity, revenue management and aircraft logistics; and workflow data from finance, marketing, HR and operations. According to the ombudsman’s filing, the package relates to about 190 million flights taken by Spirit passengers.
Google was selected as the successful bidder after the August auction, with Mercor named as the alternate bidder. A group of 121 members of Congress led by Senator Elizabeth Warren and Representative Steven Horsford later said the sale would sweep in roughly 100 million emails and 500 million Microsoft Teams messages. Google has said it is “not looking to buy any personal information from Spirit” and that the information “will either be completely excluded or will be de-identified by an independent third party before Google receives any data.”
So the honest description is a sale of a company’s working records that are full of people. Former staff wrote those emails, appear in those calendars and are discussed in those HR files. That is why removing names, the step most sellers treat as enough, was never going to satisfy the people whose working lives the archive documents. We looked at those re-identification risks former airline employees raised when the sale first surfaced. This piece focuses on what the final terms changed.
The consumer protections came first
Bankruptcy law does have a privacy mechanism, and it worked here as designed. Under 11 U.S.C. § 363(b)(1), if a debtor’s privacy policy promised not to transfer personally identifiable information to unaffiliated parties, the estate cannot sell that information unless the sale is consistent with the policy, or a consumer privacy ombudsman is appointed and the court approves the sale after finding no showing that it would violate applicable nonbankruptcy law.
Spirit’s ombudsman, Lucy Thomson, filed an initial report on September 8 and a supplemental report on October 5. In the supplement, she reported that Spirit and Google had agreed to pull passenger transaction and booking (PNR) systems, refund systems, inflight purchase data and Wi-Fi sales out of the deal entirely. Those systems will not reach Google “in any form, deidentified or not.” Corporate email stays in, because it cannot be cleanly separated, so Spirit hired Tonic.ai as a de-identification agent to scrub personal data from unstructured content before transfer.
The ombudsman’s supplemental report to the court adds several conditions that buyers of any data-rich estate should expect to see again:
- The parties voluntarily adopted the California Consumer Privacy Act’s definition of deidentified data, which requires reasonable technical measures, a public commitment by the buyer not to re-identify, and contractual limits on onward transfer.
- Certified de-identification is a closing condition. Before every transfer, the agent must file a certification with the court that the approved procedures were followed.
- Thomson recommended that each certification also state how many passengers’ details were detected and removed from the unstructured data.
- Because passenger systems were excluded, she concluded that risks to children and teens no longer arise.
Her conclusion was that the potential privacy losses to the 97 million consumers who booked with Spirit had been “eliminated or mitigated.” But a footnote carries the more important point for employers: the ombudsman “did not investigate or reach any conclusion” about risks to employees or third parties.
Why workers fell outside the statute
That footnote is not an oversight by the ombudsman. It reflects the statute. The Bankruptcy Code defines personally identifiable information in terms of information an individual gives the debtor “in connection with obtaining a product or a service from the debtor primarily for personal, family, or household purposes.” A pilot’s fatigue report or a flight attendant’s disciplinary file does not fit that definition. The ombudsman role, the privacy-policy test and the court finding in § 363(b)(1) were all built around customers.
The Association of Flight Attendants-CWA put it bluntly in its November 10 statement: there are “no privacy protections for workers in the Bankruptcy Code, federal, or state law.” As a summary of the bankruptcy framework, that is accurate. As a statement about all U.S. law, it is broader than the picture. California’s privacy statute has covered employee personal information since January 1, 2023, for example. But no general rule requires a bankruptcy court to weigh employee privacy before approving a data sale, which is why the unions had to win their protections through objections and negotiation.
The pattern is familiar from other insolvencies where data was the most valuable asset left, from genetic testing to AI chat logs. Our coverage of the 23andMe bankruptcy and of what happens to AI chatbot conversations in a bankruptcy sale traces the same question: who speaks for the people in the dataset when the seller is gone?
What the unions won
The Association of Flight Attendants-CWA filed the first objection in August. The Air Line Pilots Association, the Machinists union, the Professional Airline Flight Control Association, TWU Local 570, the Allied Pilots Association and the Southwest Airlines Pilots Association joined in September. According to the union and contemporaneous reporting, the revised terms filed in the Southern District of New York on November 9 provide the following.
- Broader exclusions. About 20 categories of employee information will be kept out of the sale, including health and medical records, disability information, drug and alcohol testing, disciplinary files, payroll and bank records, identification documents and confidential labor investigations.
- Aviation safety records stay out. Excluded material includes crew fatigue reports and data from voluntary safety programs such as the Aviation Safety Action Program, Line Operations Safety Audits and Flight Operations Quality Assurance, along with recordings of flight attendants, biometric data and some training records.
- A stronger de-identification standard. Remaining data will be de-identified under ISO/IEC 27559, an international privacy-enhancing de-identification framework, instead of the U.S. standard Spirit originally planned to use.
- Independent verification. An independent verification agent, chosen in consultation with the unions, will review the de-identified output.
- Use restrictions on the buyer. Google may not attempt to re-identify the data and must process it in a secure environment and treat it as confidential.
Reuters reported that a bankruptcy judge is expected to consider approval next week. Until the court signs an order, the terms remain a proposal, and the final sale order is the document to read for the binding version.
Lessons for anyone holding workforce data
Most companies will never auction their inboxes. But the AI data market has turned ordinary operational archives into assets with a price, and the same questions now come up in vendor deals, data licensing and mergers. Several practical lessons follow.
- Treat employee data as in scope for disposal planning. Data maps and records schedules often focus on customer systems. The Spirit sale shows that email, chat and HR systems can be the valuable and risky part of a data asset.
- Decide which categories should never leave. The exclusion list here, covering medical, testing, disciplinary, payroll and safety-program records, is a reasonable starting template for any data sale or licensing deal.
- Specify the de-identification standard in the contract. “Anonymized” is not a standard. Naming a framework, such as the CCPA definition or ISO/IEC 27559, and requiring testing for indirect identifiers and free-text leakage makes the promise auditable. Our primer on de-identification for data privacy covers the main techniques, and European regulators’ work on anonymization and re-identification risk is a useful test for whether a method holds up.
- Bind the purpose, not just the data. A ban on re-identification and onward transfer, plus secure processing terms, travels with the data in a way a privacy notice cannot. That is the practical version of putting purpose limits into the system rather than leaving them in a policy.
- Expect stakeholders who were not in the room. Unions, lawmakers and an ombudsman all shaped this deal. Employee representatives in particular are likely to push for contract terms on data used for AI training.
Frequently asked questions
Is Google buying the personal data of Spirit employees?
Not by design. The sale covers enterprise records that must be de-identified before transfer, and the most sensitive employee categories are excluded altogether. The unions’ concern was that people can still be identified from emails and chats, which is why the de-identification method and independent review mattered.
Has the court approved the sale?
Not as of November 11, 2026. The objections were withdrawn, and Reuters reported that approval is expected to be considered next week.
Why did the ombudsman not consider employees?
Her mandate comes from the Bankruptcy Code’s consumer privacy provisions, which define protected information by reference to individuals buying products or services for personal or household use. Employee data falls outside that definition.
Does the CCPA protect employee data in a case like this?
The CCPA has applied to California employee information since 2023, and the parties borrowed its deidentification definition. Whether and how state privacy law would constrain a bankruptcy sale of worker data has not been tested in this case.
The archive is the asset
Spirit no longer flies. If the court agrees, its scrubbed inbox will go to work on Google’s AI. The safeguards in this deal came from union objections, an ombudsman’s scrutiny of consumer data and a buyer that wanted a clean closing, not from any rule protecting workers. Companies that want a better answer for their own staff will have to write it into their contracts and retention schedules before a buyer comes asking.
