Spirit Airlines, the budget carrier that stopped flying in May, according to a news report, is selling off what it owns in bankruptcy court, and has picked Google to buy its internal data for $10 million, a sale the court must still approve. On Thursday, Oct. 8, Rep. Steven Horsford of Nevada and Sen. Elizabeth Warren led 119 other members of Congress in a letter to Google chief executive Sundar Pichai and Spirit chief executive Dave Davis, raising concerns about the privacy of thousands of current and former Spirit employees. The lawmakers say the data is meant for training artificial intelligence systems, and call the sale "uncharted territory."
The lawmakers point to court findings that the sale would include about 100 million emails, 500 million messages on Microsoft Teams, a workplace chat app, employee records, timecards, payroll and tax information, and employment contracts. Horsford's office says the records may hold highly sensitive details, including medical information and requests for accommodations at work, and Horsford says nearly 1,000 people in Las Vegas alone were laid off from Spirit. Court filings show Google won an auction for the data in August, with Mercor, an AI data and recruiting startup, as the backup bidder, and another AI training company, micro1, has since said it plans to make a higher offer.
Google has said it will not receive information that identifies anyone and that an outside company will scrub the data before it is handed over. That process is called de-identification: removing the names and other details that tie records to the people they are about. The lawmakers say it may not be enough. Removing names, email addresses and other direct identifiers does not necessarily make a dataset anonymous, they write, because AI systems can find patterns across huge collections of data and connect seemingly unrelated pieces, possibly working out information about individual workers or small groups. They note that the National Institute of Standards and Technology, the federal agency that develops technical standards and guidance, has recognized that de-identified data can in some cases be traced back to people.
The letter asks the companies to leave employee information out wherever they can, including payroll, timecards and training records; to give extra protection to disciplinary, medical and pay records even after names are removed; to have an independent review before anything moves; to set enforceable limits on later use; and to ban using the data to profile groups of workers. It also asks them to drop all records from voluntary safety programs that rely on pilots and other staff reporting problems, warning that leaks could make people stop cooperating. No employee information should move until those protections are in place, the lawmakers say. Unions for airline flight attendants and pilots, including the union that represents Spirit's flight attendants, back the letter.
In an Oct. 5 report to the U.S. Bankruptcy Court in New York, Lucy Thomson, the independent official the court appointed to advise it on customers' privacy, recommended approving the sale after Spirit and Google agreed to drop passenger booking and purchase records from it. She wrote that this significantly reduces the risk to the 97 million people who gave Spirit their personal data to book flights. Corporate emails stay in the sale and will be scrubbed by an outside company, Tonic.ai, which is to certify to the court before each transfer that, in its professional opinion, the data has been de-identified. Under the sale terms, Google must publicly promise not to try to work out who the data is about, and may pass it on only to someone who makes the same promise. Thomson wrote that she did not look at whether the sale poses risks to employees.
A judge is set to consider the sale at a hearing on Oct. 14, according to a news report, and the court has the final say. In a statement quoted in a news report, Google said it is not looking to buy any personal information from Spirit, that such information will be left out or removed by an independent company before Google gets any data, and that it is already working with Thomson. Neither company has said publicly whether it will take the specific steps the lawmakers asked for, and it is not yet clear which AI systems the data would help train.