GoKawiilLast Friday, Google won an auction to acquire a huge amount of Spirit Airlines data.
The data doesn’t include personal information or customer data, but instead nearly covers the airline’s entire employment and workplace record.
To ensure that no individual can be identified in the dataset, Google agreed to use a court-appointed ombudsman to oversee a process to strip any personally identifying information (PII) from the data before it’s transferred to Google. Under the deal, Google agreed to maintain the data in this de-identified form and to never intentionally re-identify the data. And if Google sells access to the data, third parties would supposedly be bound by the same terms.
It may sound like a solid plan if you ever flew on Spirit Airlines and interacted with an employee by email or chat. However, Google’s privacy commitments protecting Spirit customers don’t seem to extend to former Spirit workers. Panicked by the deal, former flight attendants are now rushing to object, worried that Google has not agreed to strip confidential information that workers fear could possibly be used by Google or a third party to link them to scrubbed data.
In a court filing Tuesday, the Association of Flight Attendants (AFA), a collective bargaining unit that represents Spirit workers, argued that Google relied on consumer protection laws to guarantee the data wouldn’t contain personally identifying information (PII). However, those laws do not cover worker confidentiality, and that allegedly leaves a huge privacy loophole in Google’s deal, especially when you consider that the tech giant is buying worker data, not consumer data.
“The privacy architecture of this transaction is consumer-facing; its payload is disproportionately employee-facing,” the AFA argued. “Hence, the employee data is far more confidential than the customer data, yet receives far less protection than the customer data.”