The Estate Sale
Includes You

Spirit Airlines stopped flying on 2 May 2026, having failed to emerge from its second attempt at Chapter 11. It had flown under that name for 34 years, though the personnel records in its archive reach back further than the name does. Chapter 11 is the American procedure in which a company keeps trading while it restructures, as opposed to Chapter 7, in which it simply stops. Spirit tried the first, twice, and ended at the second. Roughly 17,000 people lost their jobs. The company owed about $8.1 billion.

What was left became an estate. That word is not a metaphor. When a company fails, its assets pass into the hands of an officer whose legal duty is to convert them into money for creditors, exactly as an executor converts a dead person's belongings. Everything the company owned becomes a lot.

On 14 August 2026, in the US Bankruptcy Court for the Southern District of New York, one of those lots went to auction. Google LLC won it at $10,000,000. Mercor.io Corporation, an AI data company, came second at $7,500,000. Those two figures are on the face of the court's Notice of Auction Results, and they are the only bids the public file discloses.

The legal instrument is a section 363 sale, and its mechanics explain why anyone bothers. Section 363 of the US Bankruptcy Code lets a failing company sell assets quickly, outside the ordinary course of business, without waiting for a full restructuring plan. Crucially, under section 363(f) the sale can pass the asset to the buyer free and clear of most competing claims against it, though the clearing has never been absolute and courts have carved out categories of liability it does not reach. Those claimants are left with a claim against the sale proceeds instead of against the thing itself. That is what a bankruptcy buyer is really paying for: not a discount, but a title that is unusually hard to chase.

Whether free and clear reaches the rights of the people described inside a dataset is a question no court has answered. Nobody has held that it does. Nobody has held that it does not. Every reported fight about a data sale has turned on a different provision, the one that summons the privacy office, and the office is where this story goes next.

Here is what $10 million bought, as itemised in the sale documents:

Read the last line again. The framing repeated almost everywhere is that customer data was excluded. Customer data of a particular kind was excluded: 97.5 million customer profiles, 50.2 million Free Spirit loyalty accounts, 740,000 co-branded cardholder records, 30.87 million call recordings, 13.7 million marketing email addresses. But 190 million passenger name records went with the sale, with the names taken off. And Reuters reports the estate kept the right to sell customer spending data separately, to travel and hospitality buyers. Excluded means excluded from Google's lot. It does not mean withheld from the market.

Google's statement was narrow and carefully drawn: "We acquired part of an enterprise dataset from Spirit Airlines, which can be helpful in improving our products and AI models." A spokesperson added that the data would be "rigorously scrubbed of any personally identifiable information by a third party before receipt" and that "We will not receive any personal information from this dataset."

Neither sentence is untrue. Both are narrower than they sound. Hold on to that phrase, personally identifiable information, because in an American bankruptcy it is not a description. It is a statutory term with a narrow definition, and the whole transaction turns on it.

Why buy any of this. In June 2024 the research group Epoch AI put the effective stock of public human text at around 300 trillion tokens, a token being roughly three quarters of an English word. Its 90% range is wide, from 100 trillion to 1,000 trillion. Training datasets have been growing at about 2.4 times a year, which on the central estimate exhausts the supply around 2028. Epoch has been wrong before, and wrong in the direction that flatters this article's argument: its 2022 paper put exhaustion of high-quality text several years earlier, then revised the stock upward. Treat the date as soft and the direction as fixed. Everything that can be scraped has a floor, and every frontier lab can now see roughly where it is.

Ansari's company sent Spirit's lawyers an offer of $12,500,000 on 19 August, five days after the auction closed and on the morning of the approval hearing. His argument, as reported, is that the mess is the point: a tidy dataset teaches a model nothing about working in real conditions. That offer is still live before the court. So is an objection from the flight attendants' union. Judge Sean H. Lane adjourned the hearing by three weeks and will hear it on 9 September 2026. As this piece goes out, nothing has been approved. One detail matters for what happens after that date. Under section 363(m), an objector who fails to obtain a stay and then watches the sale close to a good faith purchaser will struggle to unwind it on appeal. The Supreme Court held in MOAC Mall Holdings v Transform Holdco in 2023 that this limits the relief a court can give rather than stripping it of jurisdiction, which sounds like a softening and is not much of one. Once the money moves and the data moves, an appeal has very little left to undo. In practice the hearing is not one stage in a long argument. It is close to the whole of it.

Could this happen in Britain. Yes, and with less friction. The mechanism has three parts and Britain has all of them. A company enters administration or liquidation under the Insolvency Act 1986. An office holder takes control with a statutory duty to realise value for creditors. Databases and code are property of the estate, held through copyright and database rights, and they are saleable. What Britain does not have is the American safeguard you are about to meet, because no equivalent office exists here at all. Set against that, no publicly reported British sale of an internal corporate archive to an AI buyer has yet happened, and there is a reason to think one would be harder: British data protection law travels with the data and does not fall away on a sale. We come back to all of this. First, the safeguard.

Buried in the Spirit sale documents is a phrase that decides everything. The estate must deliver the archive de-identified, to the standard of the California Consumer Privacy Act or the American health-data rules at 45 C.F.R. § 164.514, and must certify that it has done so. Then comes the qualifier:

Referential integrity is a term borrowed from database engineering, and it means the links survive. Names are replaced with tokens, but the same person's token is the same token everywhere. One individual's chain therefore stays intact: the email raising a problem, the ticket it became, the code commit that fixed it, the flight that departed on time afterwards.

That distinction has a name in law, and it is the difference between two words that sound interchangeable. Anonymised data cannot be traced back to a person by any means reasonably likely to be used, and it falls outside data protection law altogether. Pseudonymised data has had the identifiers swapped for tokens but remains relinkable, and in Britain it is still personal data, still fully regulated. A file that preserves referential integrity is, by construction, the second thing.

The chain is also the entire reason the archive is worth $10 million. A frontier AI lab training a model to do work does not want more prose. It has read the internet. What it lacks is the recorded shape of a decision: the state of the world, the action taken, the result. That triple is what the labs call a trajectory, and it is the scarce input. Public text captures outcomes. An internal archive captures the causal graph of labour. Strip the links and you have a pile of disconnected sentences. Keep the links and you have a training set.

You also have a person.

The Association of Flight Attendants-CWA filed a limited objection on 18 August. It does not ask the court to stop the sale. It asks for the crew records to come out, or for review protocols to go in. The argument is precise:

On mechanism, the union argues that a tokenised set can still disclose which crew bases generated grievances, how a small group performed in recurrent training, which is the mandatory periodic recertification cabin crew must pass, and which employees were under investigation. Cross-reference a tokenised chain against public flight schedules and known incident dates, and at an individual crew base the numbers are small enough to do the rest. Sara Nelson, the union's president, made the commercial point more bluntly. Spirit flight attendants, she says, have still not been paid their accrued holiday and sick leave, and selling their data on top of that is "adding insult to injury", as she told Fortune.

The academic literature is not on the buyer's side, though it is more contested than the headline numbers suggest. Latanya Sweeney showed in 2000 that 87% of Americans could be uniquely identified by three details: sex, date of birth and ZIP code, an area averaging some eight thousand people, against a British postcode covering roughly fifteen properties. Philippe Golle re-ran the same test on newer census data six years later and got 63%, which is the figure the field now argues about. Yves-Alexandre de Montjoye and colleagues showed that four points of time and place identify 95% of people in a mobile phone dataset covering 1.5 million subscribers in one European country. Rocher, Hendrickx and de Montjoye, publishing in Nature Communications in 2019, modelled that 99.98% of Americans would be correctly re-identified in any dataset using fifteen demographic attributes. That last figure is a statistical projection rather than an executed re-identification, which is worth knowing before you repeat it.

Against that, the British regulator's threshold is not zero risk. The Information Commissioner's Office finalised its anonymisation guidance on 28 March 2025 and applies a motivated intruder test: a hypothetical person who is "reasonably competent", "has access to appropriate resources (eg the internet, libraries, public documents)" and "uses investigative techniques". You must reduce the risk of identification to "sufficiently remote".

If a British company you worked for went into administration tomorrow, three things would be true, and none of them is what you would guess.

There is no privacy office. The Consumer Privacy Ombudsman is a creature of the US Bankruptcy Code. Administration and liquidation under the Insolvency Act 1986 have no analogue: no statutory appointee, no court-appointed privacy examiner, no mandatory report. What exists instead is the insolvency practitioner's own duty, as the party legally responsible for the data, to comply with UK GDPR, supervised by the ICO in the ordinary way. That is weaker in one respect and stronger in another. Weaker because nobody is appointed to look. Stronger because, unlike an American section 363 sale, British data protection law does not sell free and clear. Your rights travel with the file into the buyer's hands.

The rule everyone cites does not exist. Something narrower does. The Insolvency Service's live operational guidance for Official Receivers, at its own Chapter 39, updated on 20 April 2026, says a purchaser may use a database only for the purposes for which the information was originally collected and within "the reasonable expectations of the individuals concerned". Its worked example is a dental practice: the patient list should go to "another dentist providing similar dental treatments". Paragraph 39.123 adds that "if a database is sold affected individuals must be told who now has their information". That is restrictive, and it is also narrow: Chapter 39 is operational guidance for Official Receivers, who act in compulsory liquidations and bankruptcies. It does not bind an administrator running a private administration, which is the scenario this section opened with. The often-cited rule that data must stay within the same trade traces to an ICO good practice note from 2006 that is no longer published. The ICO's current data sharing guidance, updated on 9 September 2025, treats a database sale as ordinary data sharing and does not mention insolvency at all.

You do not own your work emails. Neither does your employer. English law has spent a decade circling this and declining to land. The old rule was that personal property came in two kinds: things you can physically hold, and things you can only enforce through a court, such as a debt or a share. Digital records fit neither. In Your Response Ltd v Datateam Business Media Ltd [2014] EWCA Civ 281 the Court of Appeal held that an electronic database is not something you can possess, so a supplier could not hold one hostage against unpaid fees. In Fairstar Heavy Transport NV v Adkins [2013] EWCA Civ 886 the same court gave a company the right to inspect business emails held by a former chief executive, but grounded that right in the law of agency and expressly declined to decide whether information can be property at all. In Capita plc v Darch [2017] EWHC 1248 (Ch) an employer's property claim in its own emails failed.

There is a further twist about who is even responsible. When a company goes under, the insolvency practitioner does not become the guardian of your data. In Re Southern Pacific Personal Loans Ltd [2013] EWHC 2485 (Ch), decided under the previous data protection regime and never revisited since, the court held that officeholders are not personally responsible for data protection compliance in respect of data processed by the company. They act as its agents; the company, which by then is a corpse, remains the controller. The Information Commissioner argued for the opposite result in that case, wanting the practitioner on the hook personally, and lost.

So your employer has custody, not title. You have neither. And once your employer is dead, the thing legally answerable for your file is the dead company. And the Property (Digital Assets etc) Act 2025, in force since 2 December 2025, has just removed the categorical objection that kept this tidy: a thing is no longer barred from being property merely because it is neither of the two old kinds. The Act was written for crypto-tokens. Whether it reaches a corporate email archive is an open question nobody has litigated.

What does work, modestly, is the subject access request: a written demand that an organisation tell you what personal data it holds about you and give you a copy. It applies to the buyer once the buyer holds your file. And paragraph 39.123 above means that in an Official Receiver case you are entitled to be told who now has your information, which is a live and under-used entitlement.

And it does happen here, quietly. When Debenhams collapsed, its administrators at FRP Advisory sold the global rights to the brands and the websites to Boohoo for £55 million in January 2021. FRP's own announcement mentions brands and websites; law firms writing up the deal say the intellectual property included customer data. Which is the British pattern in one sentence: the thing you would most want to know is the thing the public record does not say.

Sometimes the answer is that nothing was sold. Wonga's administrators at Grant Thornton said plainly that the remaining loan book would not be sold to a debt collector. When Carillion was wound up in January 2018 it employed around 18,200 people in Britain; 11,739 of those jobs moved to new suppliers and 2,340 were made redundant. What became of the personnel records is not discussed in the National Audit Office report, the Official Receiver's updates, or anywhere else on the public record. Not because it was hidden. Because in Britain nobody has to say.

The nearest British parallel cuts against that, and it is worth being precise about why. The Information Commissioner's Office executed a warrant at Cambridge Analytica in March 2018 and carried out 42 laptops and computers, 31 servers and around 700 terabytes. That was six weeks before SCL Elections collapsed into insolvency, so it is not a case of a regulator reaching into an estate. What happened next is the interesting part. The enforcement notice was not about the voter profiles or the psychographic models. It was about a single subject access request, made by an American academic, David Carroll, who wanted to see his own file. SCL ignored it, and the company was prosecuted and fined £15,000 while already in administration. So a dead company can be answerable after all. It cost one man years, and the answer was £15,000.

One of the two levers above has been quietly narrowed. The Data (Use and Access) Act 2025 brought most of its data protection provisions into force on 5 February 2026, with a further tranche in June, and it moved in one direction. It named a short list of "recognised legitimate interests", mostly public-interest purposes such as crime prevention and safeguarding, that a controller can rely on without weighing your interests against its own. It set out categories of further processing that are treated as compatible with the purpose data was first collected for. And it capped subject access: the search need only be "reasonable and proportionate", which is the organisation's judgement of proportionate, not yours. That last provision is deemed to have been in force since 1 January 2024, eighteen months before the Act was passed. Every subject access request sent in 2024 was retrospectively governed by a standard that did not exist when it was sent.

Meanwhile the ICO's flagship attempt to discipline the data broking industry ended in defeat. Its 2020 enforcement notice against Experian was cut down by the First-tier Tribunal in February 2023, and on 22 April 2024 the Upper Tribunal dismissed the Commissioner's appeal on all five grounds. The ICO announced a month later that it would not appeal further. The tribunals did find that Experian had breached its transparency duty, and rejected the argument that cost alone excuses notifying people. But they declined to order retrospective notification of the 5.3 million people affected, and imposed no penalty.

Britain also has no register of data brokers and no single deletion route. California has both: a public registry, and a Delete Request and Opt-Out Platform live since January 2026, through which one request reaches every registered broker. From August 2026 those brokers must check it every 45 days or pay $200 per request per day. A British resident wanting the same outcome must first work out which companies hold your data, from no public list, and then write to each one.

Your instinct on reading about the Spirit sale is that a rule was broken. No rule was broken. Every actor behaved correctly.

The estate had a duty to realise value for creditors, and it realised value. The buyer bought a lawfully marketed asset under a court-supervised process and agreed to de-identification terms it was not required to agree to. The court applied a statute that does what it says. The union filed the objection open to it. The privacy office that exists was not triggered, because the material being sold was never the material it was written to protect.

And notice who was in the room. Seventeen thousand people lost their jobs when Spirit stopped flying. The lot holds 175,658 personnel records reaching back to 1986, and the filings do not say whether that is a count of people or of files, so the honest position is that the population inside the archive is somewhere between seventeen thousand and something much larger. Not one of them was a party to the sale, and neither, until the moment of the bid, was the buyer. The archive changed hands between two parties who had no part in making it: an estate that no longer employed the authors, and a company that never had.

The gap is not a failure of enforcement. It is a definition. American bankruptcy law protects information you handed over as a customer, because in 2000 a toy shop broke a promise to parents. It has nothing to say about information you generated as a worker, because nobody in 2005 imagined that the residue of a job could be worth more than the customer list. British law has no such office at all, and arrives at the same place by a different road: your employer holds your working life without owning it, you hold rights over it without title to it, and nobody has ever successfully used those rights to stop a transfer.

The asymmetry is not about value. It is about promises. A customer list is protected, where it is protected at all, because at some point somebody wrote a sentence to a customer about what would happen to it. The work record was never protected because nobody has ever written that sentence to a worker. Twenty-six years of case law turn on a promise, and employees have never been on the receiving end of one.

What has changed is who is buying. The record of people doing the work is the one input that cannot be scraped and cannot yet be convincingly invented, and it reaches the open market at exactly one moment: when the organisation that generated it stops existing.

There is a version of this that reads as a scandal. It is not one. It is something more durable than a scandal, which is a market discovering a supply.