Law & Regulation

If Your Company Fails, Your Emails Get Sold

Google paid $10 million in Spirit Airlines' bankruptcy for 100 million staff emails and HR records. The passenger data was protected. The employee data was not - and that gap is bigger in the US than it would be under GDPR.

Law & RegulationBy Servola Tech Desk2026-08-174 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

If Your Company Fails, Your Emails Get Sold

Key takeaways

Google paid $10 million in Spirit Airlines' Chapter 11 auction for over 100 million internal company emails, hundreds of millions of Microsoft Teams chats, HR and productivity records, audits, and pricing data - and under US bankruptcy law, employee data carries none of the special protection that shielded the airline's 97.5 million passenger profiles from the same sale.
The passenger dataset was carved out and handled separately because US bankruptcy courts appoint a consumer privacy ombudsman for that category specifically; there is no equivalent court-supervised process for a bankrupt company's own staff, so their emails and reviews went into the same asset pool as the office furniture.
Google's only stated safeguard is that a third party will 'rigorously scrub' personally identifiable information before delivery - a self-defined promise, not a court-certified anonymization standard, and internal HR and productivity records are exactly the kind of data that re-identifies easily once combined with role, team, and timestamp.
Under GDPR, a European liquidator cannot treat staff emails and HR files as a saleable asset just because the company failed - the original lawful basis and purpose limitation survive insolvency, and the EU's anonymization bar is stricter than a vendor's own scrubbing promise.
Before your own wind-down plan or vendor contracts are tested this way, check whether your email, HR, and chat vendors are contractually required to destroy or return staff data on insolvency - because in most jurisdictions, if nobody wrote that clause, the data becomes just another asset.

The Auction

Spirit Airlines stopped flying in May 2026, undone by fuel costs and the trading shock of the Iran conflict. What survived the shutdown was not a fleet or a route network - it was a database. On August 17, a US Bankruptcy Court auction in the Southern District of New York closed with Google as the winning bidder, paying $10 million for a slice of the airline's internal enterprise data. An AI training data company, Mercor, had bid $7.5 million for the same lot and lost.

What Google actually bought is not a customer list. It is the interior of a company: more than 100 million company emails, hundreds of millions of Microsoft Teams chats, upward of 30 million lines of code, HR and employee productivity data, internal audits, marketing and strategy files, and pricing intelligence built from watching roughly 7 billion competitor flights. Google's own statement calls it 'part of an enterprise dataset' that will 'help improve our products and AI models.'

What Was Protected, and What Was Not

One dataset was explicitly carved out of the sale: Spirit's 97.5 million passenger profiles and more than 50 million loyalty program records. That was not a Google concession. US bankruptcy procedure appoints a consumer privacy ombudsman whenever a bankrupt estate proposes to sell data covered by a company's own privacy policy toward its customers - the court effectively has to sign off on what happens to that specific category.

No equivalent mechanism exists for the airline's own staff. The 100 million emails, the Teams chats, the HR and productivity files - all of it moved through the same general asset-sale process as the code and the pricing models, because in a Chapter 11 liquidation, data the company owns about its own employees is, by default, just estate property. Google's stated protection is that a third party will scrub personally identifiable information before delivery. That is a vendor promise made after the sale closed, not a condition the court imposed before approving it.

The Gap Nobody Priced

Every account of this deal so far has measured it against consumer protection - did the passengers' data leak, yes or no. That misses where the actual exposure sits. An employee's mailbox, performance reviews, and productivity metrics are personal data about an identifiable person exactly as much as a passenger's booking record is; the only reason they were treated differently here is that US bankruptcy law happens to name one category for special review and leaves the other to the general estate.

Run the same transaction through GDPR and the calculation changes. A liquidator does not inherit a blank check to dispose of personal data simply because the company that collected it failed - the original lawful basis and purpose limitation the company relied on to hold that data survive insolvency, and a buyer's after-the-fact promise to scrub identifiers does not, on its own, satisfy the EU's anonymization standard, which multiple data protection authorities have held requires the data to be irreversibly non-identifiable, not merely relabeled. A scrub performed by a vendor the seller chose, with no independent verification, is precisely the kind of arrangement EU regulators have pushed back on in comparable insolvency data transfers.

What This Means For Your Company

Most owners have never asked what their email provider, HR platform, or chat vendor is contractually obligated to do with company and staff data if the business fails. The default answer, in the absence of a specific clause, is: whatever the bankruptcy code of that jurisdiction allows - which, as Spirit Airlines just demonstrated, can be considerably less protective than owners assume.

Two checks are worth making this week, not during a crisis. First, read the data-processing terms in your email, HR, and collaboration-tool contracts for a clause covering deletion or return of data on insolvency or contract termination - most standard SaaS agreements do not include one unless it was specifically negotiated. Second, if your company has any wind-down or business-continuity plan on file, confirm it names who is responsible for staff data disposition, because in a genuine failure, that decision defaults to a liquidator whose job is maximizing estate value, not protecting the people who used to work there.

Frequently asked questions

Does GDPR apply to Spirit Airlines or Google in this case?

No. Spirit Airlines and its employees are American, and the transaction took place entirely in a US court, so GDPR does not govern it. The point of comparison is what a European liquidator could and could not do in the same situation.

Is a company's own staff email really personal data?

Yes. Under GDPR, personal data is any information relating to an identified or identifiable natural person. A named employee's mailbox, performance reviews, and productivity metrics plainly qualify, arguably more clearly than a passenger booking record does.

Was any of the Spirit Airlines data confirmed to be properly anonymized?

Not by an independent or court-supervised standard. Google has said a third party will scrub personally identifiable information before delivery, but that is a company commitment, not a certification, and it applies after the sale was already approved.

What should an EU or UK employer actually check?

Look for a data-destruction-on-insolvency clause in contracts with your email, HR, and chat vendors, and confirm your wind-down or continuity plan names who is responsible for staff data if the company fails.

The passenger data made headlines because the law happened to protect it. The staff data made none, and that is the part every owner should actually be worried about.

GoogleSpirit AirlinesGDPRData ProtectionBankruptcyAI Training Data

France's Court Left a Blueprint, Not Just a Veto

France's Constitutional Council struck down the under-15 social media ban on August 14, 2026, citing two specific, fixable defects. France is also piloting the EU's own privacy-preserving age-verification app, built to fix exactly the gap the court cited.

3 min read

Digital Sovereignty

Your AI Arrives Late in Europe

A July 2026 GovAI study finds the EU gets advanced AI models late or not at all, with data-protection rules the main cause. What the delay means for owners.

2 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles