Cantwell, Colleagues Urge Spirit Airlines and Google to Protect Workers’ Privacy Amid Sale of Data for AI Training

Legislators call for halt in employee data transfer until privacy protections are enacted

WASHINGTON, D.C. – U.S. Senator Maria Cantwell (D-Wash.), Ranking Member of the Senate Committee on Commerce, Science and Transportation, joined more than 120 House and Senate colleagues in a letter to Spirit Airlines CEO Dave Davis and Google CEO Sundar Pichai urging the companies to protect the privacy of thousands of former Spirit employees.

The letter responds to the proposed $10 million sale of Spirit’s internal data to Google for the purpose of training artificial intelligence systems. Court findings revealed that the proposed sale would include approximately 100 million emails, 500 million Microsoft Teams messages, employee records, timecards records, payroll and tax information, and employment contracts. Workers created and provided this information as a condition of their employment, and it may contain highly sensitive details, including medical information and accommodation requests.

“This sale presents uncharted territory,” wrote the legislators. “Innovation should not come at the expense of workers’ privacy or the confidentiality of information they were required to provide as a condition of employment. The unprecedented scale and sophistication of modern artificial intelligence make it particularly important that privacy protections keep pace with the technology.”

Sen. Cantwell and her colleagues called for no employee-related information to be transferred until protections are in place to ensure that workers’ sensitive information cannot be identified, profiled, or misused.

The letter also warned that removing names, email addresses, and other direct identifiers does not necessarily make a dataset anonymous, particularly when modern AI systems can identify patterns across large datasets and connect seemingly unrelated pieces of information. The National Institute of Standards and Technology (NIST) has recognized that de-identified data can be re-identified in certain circumstances.

The legislators urged the companies to initiate an independent review and create enforceable restrictions governing the use of sensitive employee information.

Sen. Cantwell was joined by Sens. Richard Blumenthal (D-Conn.), Lisa Blunt Rochester (D-Del.), Catherine Cortez Masto (D-Nev.), Tammy Duckworth (D-Ill.), Mark Kelly (D-Ariz.), Ed Markey (D-Mass.), Jeff Merkley (D-Ore.), Bernie Sanders (I-Vt.), Elissa Slotkin (D-Mich.), Chris Van Hollen (D-Md.), Raphael Warnock (D-Ga.), Elizabeth Warren (D-Mass.), and 108 House members in co-signing the letter. Several unions have also expressed their support for the letter.

The text of the letter is below and HERE.

October 8, 2026

Mr. Pichai and Mr. Davis,

We write to express serious concern regarding the proposed $10 million sale of Spirit Airlines’ internal data to Google for the purpose of training artificial intelligence systems and the implications of that transaction for the privacy and confidentiality of thousands of current and former Spirit employees.

This sale presents uncharted territory. According to publicly available court findings, the proposed sale would involve an extraordinary volume of Spirit’s internal records, including approximately 100 million emails, 500 million Microsoft Teams messages, employee records, timecard records, payroll and tax information, and employment contracts. This information was created and provided in the context of an employment relationship and may contain highly sensitive information about individual workers. Consumers have more privacy protections than workers, yet Spirit has collected far more private information about its employees than about its customers.

While we understand that Google has stated that it will not receive personally identifiable information and that the data will undergo third-party scrubbing before its transfer, we are concerned that conventional de-identification safeguards may not be sufficient to protect employee privacy in the context of modern artificial intelligence. Removing names, email addresses, or other direct identifiers does not necessarily make a dataset anonymous. As we have seen time and time again, artificial intelligence systems have been able to identify patterns across large datasets, connect seemingly unrelated pieces of information, and potentially infer or reconstruct information about individuals or identifiable groups. In fact, the National Institute of Standards and Technology has recognized that de-identified data can – in some circumstances – be re-identified and has emphasized the importance of evaluating re-identification risks.

That is why, before any employee-related information is potentially approved and transferred, we urge Google and Spirit to take the following steps:

1. Exclude employee information from the transaction to the greatest extent possible. At a minimum, employee training records, timecards, payroll information, and Microsoft 365 content containing flight attendant information should be excluded from any data transferred to Google. Where information can be segregated without compromising legitimate business records, employee information should not be included in the transaction simply because it is technically capable of being transferred.
2. Establish a meaningful de-identification protocol agreed upon by the affected workers. Any de-identification protocol should be developed with meaningful input from affected employees and should account for specific risks associated with combining large volumes of employment, communications, and operational data.
3. Protect sensitive employee information even when it has been de-identified. Employee information should not be treated as non-sensitive simply because direct identifiers have been removed. Spirit and Google should ensure that disciplinary records, training deficiencies, medical or accommodation requests, compensation information, and other sensitive employment information receive heightened protections. Those protections should also account for the possibility that individuals or small groups of workers could be identified through combinations of communications, operational records, crew base information, employment history, or other datasets.
4. Establish an independent employee confidentiality review and meaningful limits on downstream use. An independent review should be conducted of all employee-related information proposed for transfer to determine whether it contains confidential or sensitive information, including information that could become identifiable when combined with other datasets. Any transfer should be subject to enforceable restrictions governing the subsequent use, disclosure, retention, or transfer of employee information by Google or any third party.
5. Establish a formal review protocol and prohibit profiling identifiable groups of workers. Where employee information cannot be excluded, Spirit and Google should establish a formal review protocol for labor records, disciplinary records, training information, and employee communications before any transfer occurs. The parties should also expressly prohibit the use of the data to identify, profile, evaluate, or draw inferences about identifiable groups of flight attendants or other workers.
6. Exclude Information Related to De-Identified Voluntary Safety Programs. Exclude all information relating to voluntary safety-related programs, including but not limited to fatigue management, the Aviation Safety Action Program (ASAP), Flight Operations Quality Assurance (FOQA), and Line Operations Safety Assessments (LOSA). Airline safety relies on voluntary reporting by pilots and other employees. Inadvertent disclosure of safety-related data either through improper de-identification or otherwise threatens future cooperation in these vital programs for the FAA, air carriers and other participants.

Innovation should not come at the expense of workers’ privacy or the confidentiality of information they were required to provide as a condition of employment. The unprecedented scale and sophistication of modern artificial intelligence make it particularly important that privacy protections keep pace with the technology.

We therefore urge Google and Spirit to address these concerns and establish meaningful, enforceable safeguards before the proposed transaction proceeds. At a minimum, no employee-

related information should be transferred until appropriate protections are in place to ensure that workers’ sensitive information cannot be identified, profiled, or misused.

Sincerely,

###

Legal Disclaimer:

EIN Presswire provides this news content "as is" without warranty of any kind. We do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.