A company’s historical data may be one of its most valuable AI assets. At the same time, that data may also contain decades of privacy obligations, contractual restrictions, privileged communications, trade secrets, and third-party content—none of which was initially collected with AI training in mind.
The proposed sale of Spirit Airlines’ internal business data to Google as part of Spirit’s bankruptcy proceedings makes that tension concrete. Google reportedly won a bankruptcy auction with a $10 million bid for an archive said to include approximately 100 million emails, 500 million Microsoft Teams messages, spreadsheets, calendars, software code, and operational, marketing, and employee records. Although Google has said it is not seeking personal information—and that such information will be excluded or de-identified by an independent third party before transfer—the deal has nonetheless drawn objections from unions, vendors, privacy advocates, and more than 120 members of Congress.
The sale remains subject to bankruptcy court approval, but whatever the court decides, the lesson extends well beyond this transaction. Spirit is unlikely to be the last company whose archive is marketed as AI training data. AI developers increasingly want proprietary datasets to train, fine-tune, and evaluate their systems, and data holders—including operating companies, distressed businesses, and their creditors alike—are recognizing new value in records collected for entirely different purposes. Before either side prices a deal, it should determine which legal rights and obligations travel with the data. The five questions below are a practical starting point.
What is actually in the dataset?
Labels such as “customer data,” “operational data,” or “historical communications” are not enough. Both the data holder and the prospective buyer or licensee need a defensible inventory of the systems, record types, time periods, jurisdictions, and individuals represented in the dataset. That inventory should look past obvious personal information to identify:
- Personal and sensitive information about customers, employees, applicants, contractors, and other individuals;
- Confidential information received from customers, vendors, business partners, and other third parties;
- Attorney-client communications, attorney work product, and material subject to litigation holds;
- Source code, documents, images, and other content owned or licensed by third parties; and
- Trade secrets, security information, credentials, and records that could expose internal systems or business methods.
Unstructured archives—such as emails, chats, attachments, and meeting notes—demand particular care. Names and account numbers are far easier to find in a structured database than in years of free-form communications and documents. Sampling should be risk-based and broad enough to catch what the seller’s data map missed, and the parties should confirm whether metadata, deleted items, backups, and linked repositories are included.
Valuation depends on this work. A large dataset may be worth little if its most valuable portions must be excluded, while a smaller, well-documented dataset with clear provenance may be more useful for training and easier to license.
Does the seller have the right to transfer data for AI use?
Possessing data is not the same as having an unrestricted right to sell or license it. Relevant rights and limits may arise from privacy notices, employee policies, customer and vendor contracts, IP assignments, inbound data licenses, open-source terms, confidentiality agreements, and applicable law. Diligence should address at least three questions:
- Can the seller transfer the data to this buyer?
- Can the buyer use the data for the proposed AI purpose?
- Can the buyer retain and commercialize what training produces?
The answers often differ. A contract may permit disclosure to a service provider, but not an outright sale. A privacy notice describing internal analytics likely does not cover model training by an unrelated company; regulators have signaled that quietly expanding privacy terms to permit AI training can itself be an unfair or deceptive practice.
Employee data deserves specific attention: Under the California Consumer Privacy Act (CCPA), for example, employees’ and job applicants’ personal information is now generally subject to the same rights and “sale” restrictions as consumer data. An employee may have assigned work product to the employer, yet an email thread may still contain a third party’s confidential or licensed material.
Bankruptcy does not eliminate this analysis. Section 363(b)(1) of the Bankruptcy Code restricts the sale of personally identifiable information where the sale would conflict with the debtor’s privacy policy, generally requiring either consistency with that policy or court approval after appointment of a consumer privacy ombudsman under Section 332. The Federal Trade Commission has long intervened in such sales, but that framework is consumer-focused. The Spirit objections show that workforce data, privileged material, and contractual confidentiality can raise issues outside it. Neither court approval nor ownership of the servers resolves every restriction embedded in the records.
Can sensitive material be removed without destroying the data’s value?
De-identification reduces privacy risk, but it is not the same as deleting names. A record can identify a person through context: job title, location, dates, unique events, or links to other records. The challenge grows with free-form text, especially when the buyer needs to preserve the context that links records to one another, such as email threads, metadata, attachments, and related documents. Legal standards also vary: The CCPA, for instance, treats data as de-identified only if it cannot reasonably be linked to an individual, the holder publicly commits not to re-identify it, and the holder contractually binds recipients to do the same.
The transaction documents should define the required standard and the process for meeting it, which may include:
- An independent de-identification provider with documented methods and qualifications, informed by recognized guidance such as the National Institute of Standards and Technology (NIST);
- Record-level exclusions for categories that should not be transferred at all, including privileged or highly sensitive material;
- Testing for reidentification risk, including against external data that could restore identity;
- Certification before each transfer, not only at the outset; and
- Contractual prohibitions on re-identification, backed by technical and organizational controls
The parties should agree in advance about what happens when prohibited material is found, which records can be remediated, and which must be removed, and adjust pricing and closing conditions if exclusions materially reduce utility.
Confidentiality needs its own analysis. A fully de-identified document can still reveal a vendor’s pricing, a security vulnerability, a legal strategy, or a trade secret. Privacy, privilege, and contractual confidentiality reviews are related but distinct workstreams.
What can the buyer do with the data and with what it creates?
A conventional data license describes a permitted purpose. An AI transaction needs more precision because the original records can spawn new assets: cleaned datasets, annotations, embeddings, evaluation sets, fine-tuned models, model weights, and outputs. The agreement should address each relevant layer rather than rely on a general right-to-use data “for AI,” including:
- Which models, systems, and affiliates may use the data;
- Whether use is limited to training or extends to testing, product development, and commercial deployment;
- Whether the data may be combined with other datasets or shared with model providers, subprocessors, or research partners;
- Who owns or may use derived datasets, embeddings, model improvements, and other artifacts;
- Whether the buyer must prevent outputs from reproducing confidential or personal information; and
- Retention, deletion, security, audit, and incident-response obligations.
Restrictions must follow the data through the buyer’s technical stack; a contractual limit means little if cloud vendors, model providers, or affiliates can use the records on broader terms. Intellectual property questions also persist: the US Copyright Office’s report on generative AI training underscores that whether training on copyrighted works is a fair use remains a fact-specific, unsettled question, so licensed and third-party content in an archive is a real risk, not a footnote.
Termination deserves careful drafting. Deleting source files may not remove their influence from a trained model. In several enforcement actions, the Federal Trade Commission (FTC) has required companies to delete not only improperly obtained data but also models and algorithms built with it. The parties should specify whether deletion, retraining, model retirement, or another remedy applies if rights expire or prohibited material surfaces after training begins.
Who bears the risk if the dataset is not what the parties expected?
Diligence reduces uncertainty, but rarely eliminates it, especially for a large historical archive. The contract should allocate residual risk based on who controlled collection, who can test the data, and who decides how it is used.
Key provisions should include:
- Representations on authority
- Privacy notices
- Contractual restrictions
- IP rights
- Regulatory compliance
- Litigation holds
- Security
- The completeness of disclosed exclusions
- Whether those representations are qualified by knowledge, materiality, time period, or scheduled exceptions.
Remedies deserve equal attention: indemnities, liability caps, holdbacks, insurance, and termination rights should account for privacy claims, confidentiality breaches, IP disputes, regulatory inquiries, and the cost of removing data or retraining a model. The agreement should also set a response process for challenges from former employees, customers, vendors, or regulators.
A staged structure can help. The buyer can start with a limited sample in a controlled environment, validate rights and quality, and expand access only as agreed conditions are met. For especially sensitive archives, the source data can remain in a secure environment where defined training or evaluation occurs without transferring unrestricted copies.
The practical takeaway
AI has raised the value of historical data, including records companies once treated as operational exhaust, but it has not turned every archive into a freely transferable asset. A dataset’s value depends on whether the buyer can lawfully use it, whether the seller can deliver it without exposing protected material, and whether the parties can control what happens after training begins.
The strongest transactions bring legal, privacy, security, product, and technical teams into diligence early. That work may narrow the dataset or reshape the deal, but it gives the buyer something more valuable than volume: data it can deploy with confidence.