On 9 September 2026, in the United States, Spirit Airlines, LLC (Spirit) sought court approval in its Chapter 11 proceedings before the U.S. Bankruptcy Court for the Southern District of New York for the sale of a substantial de-identified corporate dataset to Google LLC (Google) following a competitive auction process conducted on 14 August 2026.
Google’s US$10 million bid was selected ahead of a competing US$7.5 million bid from AI company Mercor.io Corporation (Mercor). The proposed transaction concerns a dataset reportedly comprising approximately 100 million emails, 500 million Microsoft Teams messages, 30 million lines of source code and extensive operational, financial and workforce records (the Spirit Dataset).
The transaction is significant because it suggests that the operational data generated by a business may itself constitute a valuable realisable asset in an insolvency. At the same time, it highlights the legal challenge at the centre of such sales: the features that make a dataset commercially valuable may also increase the risk that individuals can be identified or re-identified notwithstanding efforts to anonymise the data.
Emergence of Data as an Asset Class
Spirit first entered Chapter 11 proceedings in November 2024. Although the airline subsequently emerged from that process, it later experienced further financial difficulties, ceased operations in May 2026 and commenced a court-supervised wind-down of its remaining assets. Alongside efforts to realise value from more traditional assets, a competitive auction process was conducted in respect of the Spirit Dataset.
Historically, insolvency practitioners have focused on more familiar intangible assets such as patents, software, contractual rights and intellectual property. The Spirit process suggests that the ordinary by-products of running a business, including internal communications, operational records, workflow information and software repositories, may also warrant consideration as potential assets capable of generating meaningful recoveries for creditors.
For AI developers, such information may provide insights into how real organisations function in practice that are not available through public sources. The competitive auction for the Spirit Dataset demonstrates that there is commercial demand for this type of material. The central issue, however, is whether and in what form it can lawfully be transferred.
The De-Identification Process and AFA Objection
Google has stated that it will not receive personal information and that the dataset will undergo third-party de-identification before transfer. Before any transfer takes place, the Spirit Dataset is to be processed by a third-party de-identification agent, acceptable to or designated by Google, with Google bearing the associated costs and a court-appointed privacy ombudsman overseeing the arrangements.
A reported feature of the proposed structure is the preservation of the dataset’s “referential integrity”,, namely the maintenance of relationships between records across multiple systems. Preserving those links is intended to maintain the usefulness of the dataset by allowing a purchaser to analyse how the organisation functioned in practice. The auction process itself was also notable as Spirit’s advisers considered not only headline price but also the proposed de-identification methodology and transaction certainty. Google’s proposal involved an independent de-identification process, while Mercor reportedly proposed an alternative structure involving in-house de-identification.
Notwithstanding those safeguards, the transaction has attracted opposition from the Association of Flight Attendants-CWA (AFA). The AFA argues that, while consumer information has been excluded from the proposed sale, the dataset contains extensive employee-related information, including workplace communications, payroll records, personnel information and scheduling data accumulated over many years. Its concern is that preserving relationships between records may permit particular employees to be identified through pattern reconstruction notwithstanding the removal of direct identifiers.
Following the filing of the AFA’s objection, the bankruptcy court adjourned the hearing to approve the proposed sale, which was heard on 9 September 2026.
The dispute illustrates a broader issue likely to arise in future transactions involving operational datasets. The features that make a dataset commercially useful may also increase the risk that information relating to particular individuals can be isolated, linked or inferred. As a result, sales of data assets may involve considerations that are not typically present in conventional insolvency sales, including privacy safeguards, regulatory risk and the robustness of proposed anonymisation arrangements.
GDPR Anonymisation and EDPS v SRB
The distinction between removing direct identifiers and achieving genuine anonymity was considered by the Court of Justice of the European Union in EDPS v SRB (Case C-413/23). The case concerned comments collected by the Single Resolution Board (“SRB“) and transferred to Deloitte under alphanumeric codes. While the SRB retained information capable of linking the comments to identifiable individuals, Deloitte did not.
The Court confirmed that pseudonymised data are not necessarily personal data for every recipient in all circumstances. Data may remain personal data in the hands of the original controller while potentially being anonymous from the perspective of an independent recipient that lacks practical means of identifying individuals. The assessment is recipient-specific and depends on whether the recipient possesses means reasonably likely to be used to identify individuals, taking account of factors such as cost, time, labour and available technology.
The judgment therefore leaves open the possibility that a sufficiently protected dataset could be anonymous for a purchaser even where the original controller retains information capable of identifying individuals. However, information that remains identifiable from the controller’s perspective continues to constitute personal data in its hands and remains subject to the GDPR.
The European Data Protection Board’s (EDPB) Guidelines 02/2026 on Anonymisation build on this approach. The Guidelines identify three indicators of successful anonymisation: (i) no record isolation, (ii) no linkage and (iii) no inference. Satisfying all three supports a finding that the data has been successfully anonymised. The Spirit Dataset illustrates why these criteria may be difficult to satisfy in practice. A dataset deliberately designed to preserve referential integrity may facilitate linkage between records, isolation of particular individuals and the drawing of meaningful inferences regarding their conduct, performance or activities. The Guidelines emphasise that high-dimensional, record-level datasets are particularly susceptible to re-identification risks. Relevant considerations include the information available to the recipient, opportunities for cross-referencing, technological capabilities and foreseeable future developments. The EDPB also notes that contractual commitments not to re-identify individuals may assist but do not, by themselves, establish anonymity.
Importantly, anonymisation is itself a processing activity subject to GDPR requirements, including the need for an appropriate legal basis, transparency obligations and appropriate documentation. Importantly, the location of the data or the purchaser is unlikely, of itself, to determine the analysis. Both SRB and the EDPB Guidelines focus instead on the parties involved, the information available to them and the practical ability to identify individuals. Accordingly, it cannot be assumed that GDPR constraints can be avoided simply because data is stored outside the European Union or transferred to a purchaser located elsewhere.
What Irish Insolvency Practitioners Need to Know
The Spirit process suggests that operational records, communications databases, software repositories and workflow information may warrant consideration alongside more familiar categories of intangible asset. Given Ireland’s concentration of technology, software, data analytics and AI businesses, this is an issue that Irish practitioners are likely to encounter going forward.
For officeholders, the key question is no longer simply whether such datasets exist, but whether they have realisable value. That may require consideration of who owns or controls the data, whether it contains personal information, what legal or contractual restrictions apply and whether there is a realistic route to anonymisation or transfer.
Unlike more traditional assets, those questions may require specialist input. In appropriate cases, technology specialists, data protection advisers and valuation experts may be required to assess both the commercial potential of a dataset and the legal constraints affecting any proposed sale.
Conclusion
The Spirit transaction illustrates the growing tension between two competing objectives: preserving a dataset’s commercial utility and ensuring that individuals cannot be identified from it. The Spirit sale does not establish that corporate datasets can routinely be monetised in an insolvency. It does, however, highlight the need for officeholders to consider whether operational data forms part of the available asset pool and whether specialist technology, data protection and valuation advice should be obtained before conclusions are reached as to its value or transferability.
As demand for operational business data continues to grow, datasets may increasingly merit consideration alongside more traditional asset classes when formulating an asset realisation strategy.
For further information on the monetisation of data assets, data protection considerations in insolvency processes or asset recovery strategies, please contact a member of William Fry’s Technology, Data & Comms or Restructuring & Insolvency teams.
Contributed by Declan Keane & Finn O’Neill
