Can I license HR or payroll records to AI?
The short answer
The law firm Frankfurt Kurnit (FKKS) says to leave them out. It lists HR files, payroll, health and benefits, and union communications as categories to exclude outright. The Justice Department's bulk-data thresholds count payroll and health data even if de-identified. Ask counsel how both apply to your records.
HR records hold the most sensitive facts in a company. Every one is tied to a named person.
What do lawyers recommend?
FKKS's memo recommends leaving out these categories:
- privileged material
- HR and personnel files
- payroll and tax records
- health and benefits information
- union-related communications
- customer or partner confidential data
It says sensitive content stays sensitive without a name attached. Examples are disciplinary matters and pay complaints.
What did employees agree to?
FKKS says most employee handbooks and privacy policies do not cover licensing data for AI training. It repeats the FTC's warning about quiet changes after the fact. So I would pull the handbook and monitoring notices as they read when each employee started.
What happened at Spirit?
The flight attendants' union says Spirit's Assets Schedule listed three groups as "Included" (Doc 1489):
- 3,426,618 payroll records
- 1,092,000 time card records
- 175,658 employee records
The union said nearly every consumer-facing category was marked "Not Included." Nearly every "Team Member" category was marked "Included."
The union did not ask to unwind the auction. It asked the court to exclude flight attendant records. The other option it offered was an employee-confidentiality review with enforceable limits on onward transfer. See employee emails.
What does the Justice Department's data rule add?
The DOJ Data Security Program (28 CFR Part 202) sets bulk thresholds. The line is more than 10,000 US persons for personal financial or health data. It is more than 100,000 for covered personal identifiers.
Section 202.206 says the thresholds apply "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted."
The rule restricts data brokerage with countries of concern and covered persons. So an owner needs to know who owns the buyer. Whether your HR mail crosses a threshold is my reading of the rule. A lawyer has to confirm it.
Talk to an employment lawyer in your state before you sign. The rights check asks about staff messages and personal data and flags both for counsel.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
