Most Privacy Programs Plan for Vendors, Deals, and Incidents. Few Plan for What Happens to Company Data If the Business Fails.

Privacy and security programs are built around three situations: the vendor that touches company data, the transaction that transfers it, and the incident that exposes it. A fourth is now arriving in bankruptcy court, and few programs were designed for it. When a company fails, its accumulated internal records (email, chat, source code, HR files, support tickets, and operational logs) can be the asset buyers want most. Increasingly, the buyers are AI developers looking for training data that shows how a real organization actually ran.

That changes the questions a privacy program needs to be able to answer. “Who can we share this with?” is familiar. “What happens to all of it when there is no company left to keep the promises we made?” is not. This alert looks at the bankruptcy mechanics, the privacy and security gaps they expose, and practical steps for companies, lenders, buyers, and investment firms.

A New Buyer for an Old Asset Class

Buying company data through a Bankruptcy Code Section 363 asset sale is not a novel idea. Buyers have long acquired a debtor’s customer lists, marketing assets, intellectual property, and business records.¹ Where the Bankruptcy Code requires it, a consumer privacy ombudsman is appointed to assess and advise the court on the sale of personally identifiable information (PII), particularly in light of the debtor’s existing privacy policies.² Barring objections, these sales have been customary and routinely approved. Increasingly, however, AI developers are finding value in nearly every category of data, including alternative data that traditional Section 363 buyers historically viewed as having little or no value.

Technology companies are in a race to obtain as much data as possible, especially data that captures how people actually communicate and work. To get it, some AI companies now view bankruptcy asset sales as data “clearance” sales. Through a Section 363 sale, an AI developer can acquire comprehensive corporate and employee data free and clear of liens, claims, and encumbrances at a relatively low cost and use it to train AI products.³

The Spirit Airlines bankruptcy illustrates the trend. The U.S. Bankruptcy Court for the Southern District of New York has been asked to approve the sale of Spirit’s operational data to a large AI developer and tech company, which submitted the winning bid at auction. If the sale closes, the buyer would acquire, among other things, Spirit’s internally developed code, roughly 100 million corporate emails, some 500 million Microsoft Teams chats, employment data, and other operational records, which would in turn be used to improve the purchaser’s AI model. Taken together, the data could give the buyer a complete record of internal workflows, transaction logs, internal employee requests, chat streams, internal issues and how they were resolved, and employee grievances. The asset purchase agreement relies on a third-party vendor to de-identify the data by scrubbing personally identifiable information, subject to the buyer’s review.

The proposed sale has drawn privacy objections from labor unions, other parties in interest, and outside observers. The concerns go beyond the sheer volume of data included in the sale. Internal communications and HR records are inherently sensitive, and they may continue to reveal information about individual employees and human behavior regardless of the de-identification process: how employees responded to company announcements, what they said in later chats, how they conducted themselves, and the company’s internal HR strategy.

Why Internal Data Is Different

The Bankruptcy Code’s privacy protections were written with consumers in mind. The definition of “personally identifiable information” in Section 101(41A) of the Bankruptcy Code is framed around information an individual provides to the debtor to obtain a product or service for personal, family, or household purposes, and the ombudsman process in Sections 332 and 363(b)(1) of the Bankruptcy Code is focused on the debtor’s consumer-facing privacy policy.⁴ Employee email, chats, HR files, and internal workflow data do not fit neatly within that framework. This new paradigm is likely to be contested on a case-by-case basis, and employees, unions, and other parties in interest may find themselves raising concerns the Bankruptcy Code does not contemplate.

De-identification is a different problem for unstructured communications than for a structured customer database. Names, addresses, and employee IDs can be removed. Context, role, writing style, timing, and the thread of a conversation are harder to remove without destroying what the buyer is paying for. Removing an identifier does not make the content less sensitive–a disciplinary record, a leave or accommodation request, a payroll adjustment, or an internal grievance remains sensitive with or without a name attached. Several state privacy laws set their own standards for when data counts as de-identified, typically requiring reasonable technical measures, a public commitment not to re-identify, and contractual restrictions on downstream recipients. Those standards may still apply regardless of what an asset purchase agreement provides.

The estate also may not be free to sell everything it holds. Customer and vendor confidentiality terms, third-party intellectual property embedded in code, licensed datasets, employment agreements, and privacy policy commitments travel with the data. Section 363(b)(1)(B) of the Bankruptcy Code itself contemplates the court considering whether a sale of personally identifiable information would violate applicable nonbankruptcy law, which places privacy and employment considerations front and center for the Bankruptcy Court.⁵

Finally, a liquidating debtor is a poor long-term steward of this type of data. Moving hundreds of millions of records to a de-identification vendor and then to a buyer is a significant data-handling event in its own right, with chain-of-custody and security questions at each step. If something goes wrong after closing, there may be no privacy office, security team, or budget left to investigate, notify, or remediate.

The Investment Management Angle

Investment firms sit on both sides of this development. Lowenstein Sandler’s Alternative Data Survey found that 90 percent of investment firms use alternative data and that nearly 9 in 10 now have formal policies governing AI use in investment and trading.⁶ As consumers of data, firms should expect datasets that originated in distressed sales to carry the seller’s promises and the court’s conditions with them. The diligence priorities reflected in the survey (data ownership, PII exposure, and third-party cyber risk) extend naturally to provenance: where the data came from, who was permitted to sell it, and what restrictions follow it.

As holders of data, investment firms and their portfolio companies generate exactly the communications and operational records AI buyers want. The same planning gap described above applies when a portfolio company is in distress, and fund-level AI and data policies may be the right place to decide who determines what is sold, destroyed, or restricted when a company fails.

What To Do Now

For companies: privacy, security, information governance, and legal

• Treat internal communications and operational data as an asset class with obligations attached. Know what you hold, where it sits, and which promises govern it: privacy policies, employee notices, customer and vendor confidentiality terms, and collective bargaining agreements.
• Reread the privacy policy and employee privacy notice with a bankruptcy buyer in mind. “Sale of business” language written for a going-concern acquisition may not describe a sale of raw email and chat streams for AI training. The words written now are what an ombudsman, a buyer’s diligence team, or an objector will read later.
• Make records retention the first-line control. Data that was defensibly disposed of under a retention schedule is not available to be sold, scrutinized, or trained on. Many companies hold decades of emails and chats they have no business reason to keep.
• Add a wind-down chapter to the privacy and incident response program: who owns data decisions when the company is in distress, what de-identification standard applies, what is destroyed versus transferred, and who answers if there is an incident after closing.
  
  

For debtors, creditors, and lenders

• This asset class may give creditors a source of recovery that was not previously available.
• Debtors, creditors, and prospective buyers should anticipate more scrutiny of data assets in Section 363 sales, particularly where de-identification protocols are necessary and employee and labor interests are involved.
• Traditional financing documents may need to be amended. As company data becomes a more marketable asset, lenders and borrowers may want to clarify that it is collateral and reference it expressly in security agreements and UCC-1 financing statements, where it may or may not be included as a “general intangible.” Financing documents may also need terms that contemplate a future sale of data and the use of proceeds, in or out of bankruptcy.
  
  

For buyers, including AI developers

• A free-and-clear sale order addresses liens, claims, and interests in the property. Privacy policy commitments, state de-identification standards, and employment law obligations may follow the data anyway. Diligence provenance and promises before bidding, and expect purchase agreements to allocate the de-identification standard, audit rights, and downstream use restrictions.
  
  

¹ See 11 U.S.C. § 363(b)(1).
² See 11 U.S.C. §§ 332, 363(b)(1).
³ See 11 U.S.C. § 363(f).
⁴ See 11 U.S.C. §§ 101, 332, 363.
⁵ See 11 U.S.C. § 363(b)(1)(B).
⁶ Lowenstein Sandler LLP, AI’s Integration Into Alternative Data Fuels New Opportunities and Challenges (2026), https://www.lowenstein.com/media/jujd45bp/alt-data-report-2025_final.pdf.