# Can I license HR or payroll records to AI?

> Looking to sell HR or payroll records to AI? Leave them out of any license. Frankfurt Kurnit lists both as exclusions, and Spirit's union wanted that too.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/can-i-sell-hr-or-payroll-records-to-ai  
Published: 2026-08-19  
Updated: 2026-10-14

## The short answer

The law firm Frankfurt Kurnit (FKKS) says to leave them out. It lists HR files, payroll, health and benefits, and union communications as categories to exclude outright. The Justice Department's bulk-data thresholds count payroll and health data even if de-identified. Ask counsel how both apply to your records.

HR records hold the most sensitive facts in a company. Every one is tied to a named person.

## What do lawyers recommend?

[FKKS's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes) recommends leaving out these categories:

- privileged material
- HR and personnel files
- payroll and tax records
- health and benefits information
- union-related communications
- customer or partner confidential data

It says sensitive content stays sensitive without a name attached. Examples are disciplinary matters and pay complaints.

## What did employees agree to?

FKKS says most employee handbooks and privacy policies do not cover licensing data for AI training. It repeats the [FTC's warning](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive) about quiet changes after the fact. So I would pull the handbook and monitoring notices as they read when each employee started.

## What happened at Spirit?

The flight attendants' union says Spirit's Assets Schedule listed three groups as "Included" ([Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)):

- 3,426,618 payroll records
- 1,092,000 time card records
- 175,658 employee records

The union said nearly every consumer-facing category was marked "Not Included." Nearly every "Team Member" category was marked "Included."

The union did not ask to unwind the auction. It asked the court to exclude flight attendant records. The other option it offered was an employee-confidentiality review with enforceable limits on onward transfer. See [employee emails](/answers/can-i-sell-employee-emails-to-ai).

## What does the Justice Department's data rule add?

The DOJ Data Security Program ([28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202)) sets bulk thresholds. The line is more than 10,000 US persons for personal financial or health data. It is more than 100,000 for covered personal identifiers.

Section 202.206 says the thresholds apply "regardless of whether the data is anonymized, pseudonymized, de-identified, or encrypted."

The rule restricts data brokerage with countries of concern and covered persons. So an owner needs to know who owns the buyer. Whether your HR mail crosses a threshold is my reading of the rule. A lawyer has to confirm it.

Talk to an employment lawyer in your state before you sign. The [rights check](/rights-check) asks about staff messages and personal data and flags both for counsel.

Figure: comparison of Spirit's sale schedule, as the union read it: Consumer data (Nearly all out), Team member data (emphasized: Nearly all of it was in the sale, Nearly all in). The union objected because nearly all team member data was in the sale and nearly all consumer data was out.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [FKKS's memo](https://technologylaw.fkks.com/post/102o455/selling-company-data-for-ai-training-what-to-know-before-you-say-yes)
- [FTC's warning](https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive)
- [Doc 1489](https://storage.courtlistener.com/recap/gov.uscourts.nysb.331039/gov.uscourts.nysb.331039.1489.0.pdf)
- [28 CFR Part 202](https://www.ecfr.gov/current/title-28/chapter-I/part-202)