US Congressman Steven Horsford and Senator Elizabeth Warren, together with 119 other members of Congress, requested on 8 October that Google and Spirit Airlines exclude as much data as possible about former airline employees from the bankruptcy sale.
The letter was sent six days before a hearing at which Judge Sean Lane is to decide whether Google can buy most of the company’s digital archive for $10 million.
The archive contains about 100 million emails, 500 million Microsoft Teams records, more than 3.4 million salary calculations and 175,658 employee files, the oldest dating back to 1986.
Google has said it will use the data to develop its products and artificial intelligence models.
Before Google receives the archive, a specialist company hired for the job must remove names and other information that could directly reveal employees’ identities.
Passenger databases are excluded from the sale, so court-appointed consumer privacy commissioner Lucy Thomson recommended that the deal be approved. The question of employees whose work histories are transferred under a contract to which they are not a party remains unresolved.
Closed companies have been selling their internal archives to firms developing artificial intelligence for some time, but these deals have taken place far from the public eye.
Spirit’s bankruptcy is the first case in which, using a large company as an example, the cost of such an archive, its contents, the way people’s data are removed from it and the limits on its subsequent use can be examined in court.
A market operating without witnesses
As early as April, it emerged that closed American start-ups were selling internal employee messages from business platforms such as Slack, emails, tasks from project management programmes and other digital traces of companies’ daily work.
The buyers are companies that process data from such material to train AI models and then sell these models to large laboratories.
Brokerage firm SimpleClosure said at the time that, over the course of a year, it had completed close to a hundred such deals, mostly worth between $10,000 and $100,000.
The closed company cielo24 received several hundred thousand dollars for the digital archive created during 13 years of operation.
By September, material from more than 350 closed companies was being offered through the same platform, including vast quantities of software that their programmers had written and modified during their daily work over many years.
Such deals are concluded privately, without a judge and without anyone to represent the people whose work is recorded in the archive.
The archive of a large company contains the business secrets of its partners
With Spirit, it is different, because the assets of the bankrupt company are being sold by the court, and any interested party can challenge both the contents of the package and the terms of the sale.
That right has been exercised by the cabin crew union, the flight dispatchers’ association, two unions of former Fort Lauderdale employees and two pilot unions.
Software company Springshot and engine manufacturer International Aero Engines have also filed objections, claiming that the archive contains their confidential data, which does not belong to Spirit.
The archive of a large company therefore also contains the business secrets of its partners.
The value lies in the connections between records
For a customer, an individual email has little value. Value emerges when the same task can be tracked across multiple systems: from the initial notification of a fault or delay, through team discussions and technical support requests, to software modifications and the final outcome.
Publicly available material generally shows only the end product. The archive of an individual company shows how those results were achieved, who made the decisions and how long it took.
When names and other direct identifiers are removed from the archive, records relating to the same individual may still be linked.
For example, an employee’s email, a message on Teams, a software modification they made and details from the payroll can all still be identified as belonging to the same person, simply without their name attached.
The cabin crew union warns that this is precisely the problem, as combining sufficiently detailed records can still allow an individual to be identified.
The contract also specifies a dedicated redaction standard for health data, derived from US regulations on the protection of medical information. The inclusion of this clause indicates that the contracting parties assumed such records were present in the archive.
The members of Congress highlight sensitive content, including medical histories and employee requests for workplace adjustments on health grounds
In their letter, the members of Congress highlight sensitive content, including medical histories and employee requests for workplace adjustments on health grounds.
On the same day the congressional letter arrived, Google introduced a new Gemini agent for corporate clients.
According to Google, alongside its own programmes, the agent operates across Microsoft’s Office suite, Teams, Slack, and software development and workflow tools such as Git and Jira.
It can carry out multi-step tasks independently, behaving like a colleague assigned a piece of work.
These are the very systems that generated most of the records in Spirit’s archive. While Google has not stated that Spirit’s data will be used to train this specific tool, the example illustrates why buyers place such high value on archives that capture how work moves between teams and applications.
The auction revealed the cost of control
A court filing dated 17 August by Spirit’s investment banker, Dylan Friesner of PJT Partners, shows how much customers are willing to pay for the right to process data themselves.
Google opened the auction with an offer of $5 million, on condition that the data was cleansed by an external company before handover.
Mercor, a company that prepares data for large AI laboratories, then offered $5.2 million under the same condition, or $7 million if it cleansed the data itself. In the end, it bid $7.5 million with external processing, or $10 million with its own.
Mercor was willing to pay about a third more in both rounds for the right to control data cleansing itself.
Google ultimately offered $10 million, the same amount as Mercor in the self-processing option.
Spirit chose Google, and Mercor’s offer of $7.5 million with outsourced processing was designated as a backup. In his statement, Friesner said that, in addition to the price, other conditions were considered, including a clearly described procedure for removing identity data, and that such conditions could determine the outcome.
At the same price, the offer in which the customer does not cleanse the data itself was preferred.
The data will therefore not be cleansed by Google, but neither will it be handled by a completely independent party.
Google selects or approves the company that removes the identity data, pays for its work and requires the completed work to meet Google’s standards
Under the contract, Google selects or approves the company that removes the identity data, pays for its work and requires the completed work to meet Google’s standards.
The contract does not provide for a separate, independent auditor to check whether the procedure has actually been carried out properly.
Three weeks after the auction, Micro1, another data provider for AI labs, bid $12.5 million, a quarter more than Google.
Along with the higher price, it proposed stricter conditions. Sensitive work materials would be exempt, and raw employee records destroyed after cleansing.
An independent auditor would receive a sample of 1% of the cleansed data before each onward transfer, and the data could only be sold to pre-designated AI labs, subject to confidentiality obligations and a ban on re-linking the data to specific people.
The court has not yet decided whether an offer submitted after the auction can be considered at all. However, this showed that a higher price and stronger employee protection can be included in the same offer.
Contract without employee signature
Google is contractually obliged not to intentionally associate cleansed data with the names of specific individuals.
If it subsequently forwards that data to another company, the recipient must also accept the same restriction.
The problem is that former employees are not parties to that contract. This means that an employee whose emails or work files are in the archive has no contractual right to bring legal action compelling Google, or any subsequent recipient of the data, to comply with those terms.
Passengers are in a stronger position because US bankruptcy law stipulates that when consumers’ personal information is sold in bankruptcy, the court will appoint a consumer privacy ombudsman to assess the risks to their privacy.
Lucy Thomson raised objections to the sale on 8 September, and Google responded a day later.
Several other databases containing substantial volumes of passenger records – including booking and transaction details, refunds, in-flight purchases, working-time records and sales of Wi-Fi services – were subsequently removed from the sale entirely.
Google is contractually obliged not to intentionally associate cleansed data with the names of specific individuals
On 5 October, Thomson concluded that the risks to passenger privacy had been sufficiently reduced and recommended that the sale be approved.
There is no dedicated representative for employees. Their interests are represented in proceedings by trade unions, which can lodge objections, but the final decision rests with the court.
Even America’s strictest privacy laws offer employees limited protection. California law has covered employee data since 2023, and the contract with Google adopts California standards for data cleansing, yet former employees in that state still cannot, in most circumstances, bring an independent claim for breaches of those rules.
Enforcement is generally left to the state regulator and the public prosecutor, while an employee only has the right to take private legal action if their data is compromised through company negligence.
In most of the US, legal protections are weaker still, as business emails, documents and other workplace records are generally treated as the property of the employer.
Pilot unions raised a specific objection. ALPA, which represents Spirit’s pilots, and the Allied Pilots Association, an American Airlines union that includes more than 700 former Spirit pilots, are seeking protection for records from voluntary safety and training programmes.
Under these programmes, pilots report their own errors and safety incidents on the understanding that submissions remain strictly confidential, an arrangement designed to ensure airlines learn from mistakes before they lead to accidents.
In the European Union, a transaction of this kind would be subject to stricter data protection rules.
In September 2025, the Court of Justice of the European Union ruled that data stripped of names or other direct identifiers does not automatically qualify as personal data if the recipient has no realistic means of identifying the individual.
However, the company that originally collected the records remains under an obligation to inform data subjects before passing them on. In a case like Spirit’s, former employees would therefore have to be notified before their workplace records could be transferred to a new owner.
Terms from the losing bid
Google is still likely to be the buyer on 14 October, but with a more limited package and stricter conditions regarding employee data.
A short delay is also possible if the judge decides that the protections are not yet sufficiently precise.
A complete ban on the sale is unlikely because the commissioner has supported it, the scope of the data has already been reduced under pressure from objections, and the bankruptcy estate, from which Spirit’s creditors are paid, has a clear interest in selling the archive.
Micro1’s offer showed the court that Spirit’s data could be sold with stricter employee protections.
These include independent verification of some of the processed data, deletion of original work records after processing, and tighter restrictions on who the data can subsequently be shared with.
The judge may approve the sale to Google, but adopt some of the protective terms proposed by Micro1
The judge may therefore approve the sale to Google, but adopt some of the protective terms proposed by Micro1.
In that case, Micro1 would not secure Spirit’s archive, but its offer would still influence the conditions under which Google takes it over.
The same court will soon rule on the sale of Spirit’s customer list containing annual passenger spending, which the contract permits to be marketed to tourism and hospitality companies.
In those proceedings, the interests of passengers are already monitored by the privacy commissioner.
Former employees have no such representation, meaning the protection of their work histories will depend on how many demands from trade unions and Congress Judge Lane is prepared to incorporate into the contract between Spirit and Google.
