Lawmakers in the U.S. House and Senate on Thursday called on the CEOs of Spirit Airlines and Google to safeguard the privacy of employees whose information would be included in a planned mass sale of business data from the defunct air carrier to Google.

In a letter to Spirit CEO Dave Davis and Google CEO Sundar Pichai, 121 lawmakers led by Sen. Elizabeth Warren, a Democrat from Massachusetts, and Rep. Steven Horsford, a Democrat from Nevada, urged the two companies to deploy a half-dozen measures to ensure the private information of some 17,000 former Spirit employees is not compromised.

“This sale presents uncharted territory,” said the letter, which was made public Thursday.

“According to publicly available court findings, the proposed sale would involve an extraordinary volume of Spirit’s internal records, including approximately 100 million emails, 500 million Microsoft Teams messages, employee records, timecard records, payroll and tax information, and employment contracts.

“This information was created and provided in the context of an employment relationship and may contain highly sensitive information about individual workers,” the letter went on. “Consumers have more privacy protections than workers, yet Spirit has collected far more private information about its employees than about its customers. While we understand that Google has stated that it will not receive personally identifiable information and that the data will undergo third-party scrubbing before its transfer, we are concerned that conventional de-identification safeguards may not be sufficient to protect employee privacy in the context of modern artificial intelligence.

“Removing names, email addresses, or other direct identifiers does not necessarily make a dataset anonymous. As we have seen time and time again, artificial intelligence systems have been able to identify patterns across large datasets, connect seemingly unrelated pieces of information, and potentially infer or reconstruct information about individuals or identifiable groups.”

The letter urged that Google and Spirit take the following steps:

Exclude employee information from the transaction to the greatest extent possible.
Establish a meaningful de-identification protocol agreed upon by the affected workers.
Protect sensitive employee information even when it has been de-identified.
Establish an independent employee confidentiality review and meaningful limits on downstream use.
Establish a formal review protocol and prohibit profiling identifiable groups of workers.
Exclude Information Related to De-Identified Voluntary Safety Programs.

Sara Nelson, president of the Association of Flight Attendants, which represents several thousand professional attendants who once flew for Spirit, said in a statement that crew members and other former employees “are on the tip of the spear of this new threat to workers’ rights.”

She thanked the lawmakers for having “acted quickly to urge protections for workers as they face immediate risk in the bankruptcy court. But the outcome of conditions on this proposed sale to Google carries tremendous implications for workers across the economy.”

Google won a court-supervised auction for the airline’s business enterprise data with a bid of $10 million. Data and airline industry analysts viewed the transaction as a rarity, and the proposed deal quickly generated questions among labor and consumer advocates about how information usually regarded as private can remain so after the deal.

The issues prompted the U.S. Bankruptcy Court in New York overseeing Spirit’s liquidation to appoint a “consumer privacy ombudsman” to review the concerns with both companies.

Within the last week, the ombudsman, cybersecurity specialist and attorney Lucy L. Thomson of Washington, concluded in a report that sufficient measures have been proposed by both companies to allow the sale to be approved by the court.

Companies: Safeguards underway

A spokesperson for the Spirit estate said management “is working closely with the AFA and other unions on their concerns, which are reiterated in this letter.”

She said “updated sale documentation” will be filed with the U.S. Bankruptcy Court in New York  “that we think appropriately addresses or otherwise responds to those concerns.”

Late Thursday, a Google spokesperson reiterated in an email to the South Florida Sun Sentinel that the company is not interested in acquiring personal data from the airline.

“As we’ve said from the beginning of the process, we are not looking to buy any personal information from Spirit,” the spokesperson said. “The information will either be completely excluded or will be de-identified by an independent third party before Google receives any data. We’re already working constructively with the appointed privacy ombudsman.”