Frankfurt. They are numbers that show a reversal in value. The technology group Google has offered ten million dollars for internal communications data from the insolvent US airline Spirit. The US start-up Micro1 even wants to pay $12.5 million. Spirit recently sold 27 older Airbus aircraft for $668 million, or just under $25 million per aircraft. So data seems to be almost as valuable as an airplane.
Google and Micro1 want to use the information to train their AI systems. And Spirit is unlikely to remain the only company whose data it or other tech companies buy. “It is a new business model to process and make available large amounts of data as part of AI development,” says Nils Rauer, an expert in AI law at the law firm Pinsent Masons, to the Handelsblatt.
But this practice is met with resistance. Former business partners, employees and customers of the insolvent companies fear that their data will also be leaked and confidential information will be revealed. In the case of Spirit, the German airline Lufthansa had the data packages checked, and lawyers for employees and consumer representatives want to prevent the sale in court.
Spirit Airlines' data package is huge: the airline has collected 97.5 million passenger data since it began operations in 1992. There are an estimated 13.7 million active email addresses in the company's databases, plus information from the miles program - including the partner companies in the customer loyalty program. Information from a good 175,000 personnel files is also part of the sale, as is internal communication data from email programs and the messaging tool Microsoft Teams, a total of 1.5 million messages.
Communication with service providers and suppliers to the airline may also be included in the data. One of them is the maintenance company Lufthansa Technik. However, your review has shown that no confidential business information is being transferred. “We have reinsured ourselves and ensured that no information that has a connection to Lufthansa Technik will be sold or passed on,” a spokesman told Handelsblatt.
AI lawyer Rauer expects that there will be significantly more such cases in the future. In the USA, Simple Closure sells, among other things, data packages: The company supports companies that are ceasing their operations.
“This doesn’t just happen in the USA, but also in Europe,” said Rauer. In Germany, for example, Laion, a non-profit organization based in Hamburg, offers companies access to processed data packages. However, Laion also shows how legally sensitive this trade is. A Berlin photographer has filed a lawsuit against the company because he believes copyrights have been violated. The case is now before the Federal Court of Justice. Experts suspect that the BGH will refer the case to the European Court of Justice for fundamental clarification.
According to Rauer, the prerequisite for selling data is a clearing of possible rights. "A data set that is sold must not be burdened with third-party rights. You have to pour the data through a sieve and filter it, so to speak," says the AI expert, describing the procedure. There are companies that would carry out this clearing properly.
"The technical possibilities for this are available. But there are also black sheep," said Rauer. It's about personal rights, copyrights, design and trademark rights or trade secrets. “Companies have to look very closely to see whether their data is affected when they sell data packages,” said Rauer.
However, this is more complicated than it sounds. Because: Non-personal company data is generally not covered by data protection law, says Ana Hadne's brother, partner in data protection at the law firm Mayer Brown, to the Handelsblatt. These include economic key figures, technical data, information about contracts or general contact details. “The most important thing here is the contractual regulations.”
The situation in Europe is different when it comes to personal data, for example of employees. According to Bruder, the General Data Protection Regulation, or GDPR for short, only allows the collection of personal data for a specified and legitimate purpose: “If this purpose expires, the data must be deleted.” In principle, this makes it almost impossible to sell such data sets in Germany.
However, the GDPR makes it possible to sell data sets if they are anonymized. "The requirements for anonymization are very strict. Under no circumstances should the individual person be able to be identified afterwards," says Bruder.
The situation is similar in the USA. Rauer from Pinsent Masons certifies that Europe has the highest level of data protection in comparison, and that there are also differences to the regulations in the USA: “But the basic principles are similar.”
However, the Spirit Airlines case shows how difficult effective anonymization is. Google and Micro1 promise to have the data cleaned rigorously and by an independent agent. However, the US pilot representative Air Line Pilots Association (Alpa) points to an agreement in the sales contract. Accordingly, the “referential integrity” of the data must be maintained even after filtering.
The reason: The AI systems can only learn from it if the relationship between the individual pieces of information is recognizable. Therefore, it is almost certain that individual pilots and others can be identified, according to Alpa's letter to the insolvency court.
A second method of making data packages salable is so-called pseudonymization. Names are replaced by numbers and the assignment is made possible using a key. “Currently, this data is also subject to the requirements of the GDPR,” said Bruder.
There is currently discussion about adapting the GDPR so that pseudonymized data is no longer subject to its rules, for example if the buyer does not have access to the key. “The European Commission has made corresponding proposals here, including within the framework of the so-called digital omnibus,” said Bruder: “But some EU member states are against it.”
