Employee Notice and Consent When Licensing Internal Communications for AI

Before a company licenses staff emails, chats or meeting records to an AI buyer, it usually has to tell the people in them, and in some countries it has to ask them or their works council first. In the EU, Article 13(3) of the GDPR requires notice before further processing, and in the Netherlands a works council holds a consent right over rules on processing staff personal data (WOR art. 27(1)(k), checked 2026-11-09).

Notice, individual consent and collective rights are three different duties, and staff notice is one step of AI training data licensing that the seller completes before any message leaves. Not licensing staff communications is a valid outcome.

DataPacts Editorial Team checked every rule and term here on November 9, 2026, and re-checked the Spirit Airlines schedule on November 10, 2026; the page on how we source, date and check every figure sets out the rules.

What Notice and Consent Mean When Staff Messages Are Licensed

Employee notice tells staff that their messages will be disclosed for AI training before it happens, while consent asks each person for permission and can be refused.

Consent from an employee must be a real choice, and § 26(2) of the German Federal Data Protection Act (BDSG) sets its own standards for employee consent in Germany (checked 2026-11-09). Ifeoma Ajunwa of Emory University argues that employers should have express consent before selling workers' data (MIT Technology Review, October 13, 2026). The three duties differ:

• Notice: telling staff what happens to their data.
• Consent: individual permission, which each person can refuse.
• Collective step: the works council or union is informed, consulted or must agree.

Whose Messages Sit in a Workspace Archive

A workspace archive holds messages from current staff, former staff, applicants, contractors and the customers and suppliers they wrote to, and each group has its own notice position. Under § 26(8) BDSG, applicants and persons whose employment has ended count as employees, so a former employee's mailbox needs the same notice as a current one.

The scale is large. The Spirit Airlines schedule in the bankruptcy court lists 100,000,000 emails across 80,000 email accounts (Dkt. 1463, Exh. A-2), and Mercor states that Slack (55 %) and Gmail (50 %) are in use among its roughly 300 partner enterprises (LinkedIn post, 2026-09-22, checked 2026-11-09). Messages from customers and suppliers raise a separate question, covered under customer consent and confidentiality clauses.

When Notice Is Enough and When Consent Is Needed

Whether telling staff is enough or their consent is needed depends on the legal basis the company uses, and that differs between the EU and UK and the United States. The table compares the baseline duty and the trigger for more, as of 2026-11-09.

EU and UK Staff: Legal Basis, Article 13(3) Notice and Article 88

Under the GDPR a company needs a legal basis for disclosing staff messages, a compatibility test for the new purpose and a notice to staff before the disclosure. Regulation (EU) 2016/679 applies from 2018-05-25, every disclosure needs an Article 6 basis, and Article 6(4) tests the new purpose on its link to the original one, context, data nature, consequences and safeguards. The UK GDPR follows the same article numbers.

Article 13(3) requires the seller to inform staff of the new purpose before further processing. The buyer owes its own notice under Article 14(3)(a) within a reasonable period and at the latest one month, unless the disproportionate-effort exemption in Article 14(5)(b) applies with appropriate measures. The WP248 rev.01 guidelines treat employees as vulnerable data subjects, and two of its criteria met usually require a data protection impact assessment. The full rules are in GDPR and AI training data.

Article 88(2) requires national or collective employee rules to include suitable measures on transparency, intra-group transfers and workplace monitoring. The CJEU held on 2023-03-30 (C-34/21) that national rules which do not meet Article 88(2) are disregarded unless they form an Article 6(3) basis, and on 2024-12-19 (C-65/23) that they must also meet Articles 5, 6(1) and 9. In BAG 8 AZR 209/21 (2025-05-08), the Federal Labour Court left § 26(1) BDSG unapplied, accepted testing with real staff data under Article 6(1)(f) only where dummy data do not suffice, and awarded EUR 200 in non-material damages.

US Staff: CCPA Sale Rules and Stored Communications

In California, licensing employees' personal information for money is a sale under the CCPA, because the exemption for employee data stopped operating on January 1, 2023 (Cal. Civ. Code 1798.145(m)(4), (n)(3)). Employees then hold the right to opt out under section 1798.120, and de-identified data under section 1798.140(m) falls outside. Fines are USD 2,663 per violation and USD 7,988 per intentional violation (CPI-adjusted from 2025-01-01).

At federal level, 18 U.S.C. 2702 restricts public providers from divulging stored content, and a company's internal systems are generally not services offered to the public. Under the Wiretap Act, 18 U.S.C. 2511(2)(d) allows one-party consent for recordings, yet 2511(1)(c) and (d) make disclosing or using unlawfully intercepted contents a violation itself. See ECPA, the Wiretap Act and stored communications.

Works Councils and Unions: Consent, Consultation or Negotiation

Where a works council or union exists, the collective step comes on top of individual notice, and its strength ranges from information to a right of consent. The table lists the step type in seven countries, as of 2026-11-09; application to data licensing is analysis.

In Germany the Federal Labour Court held on 2016-12-13 (1 ABR 7/15) that a device is designed to monitor when it is objectively suitable to record conduct or performance, whatever the employer intends, so export and de-identification tooling can trigger § 87(1) Nr. 6 BetrVG. In the Spirit Airlines case, unions were among those who objected to the data sale, which shows that staff representatives can raise the question in the United States too. Rules for each country are collected under employee data rules by jurisdiction.

What Buyers' Terms Say About Staff Data

Buyers' published terms say little about notifying staff, but several exclude staff records outright and at least one makes the seller answer for any privacy claim. The table gives each party's own statement, as of 2026-11-09, and none of these pages states a staff notice requirement, checked November 9, 2026.

The micro1 list in s.5.7 is introduced by "among other categories", so it is not exhaustive. A staff complaint after delivery lands on the seller, as the indemnity clause of an AI data licensing agreement shows.

A Notice and Consent Sequence Before Any Message Leaves

A defensible staff notice follows a fixed order: know who is in the data, pick the legal basis, complete any collective step, then notify, ask where needed and record it.

1. Map people and systems, including former staff, applicants and contractors.
2. Choose the basis per jurisdiction, such as GDPR Article 6 in the EU or the CCPA sale rules in California.
3. Complete the works council or union step where the country requires one.
4. Run a DPIA where two WP248 criteria are met.
5. Give notice before disclosure: what data, which buyer category, the purpose, de-identification, retention and the objection route.
6. Ask for consent only where it can be a real choice, and exclude payroll, HR files, privileged material, credentials and direct messages.
7. Keep the record for the buyer's diligence.

The export tools set a practical gate. Slack's help page states that Pro exports exclude direct messages and private channels, while Business+ allows them by application with Workspace Primary Owner approval, described as for legal and regulatory compliance. The Microsoft Teams Export API needs an active Teams license for each exported user; see Slack data and AI training.

Case Study: Staff Data in the Spirit Airlines Archive Sale

The Spirit Airlines bankruptcy archive is the clearest court record of a staff-data sale for AI training, and its schedule lists employee records alongside the messages. Dkt. 1463, Exh. A-2 lists as included 100,000,000 emails, 500,000,000 Teams items, 175,658 employee records, 3,426,618 payroll records, 1,092,000 time card records and 148,018 tax forms, while 97,500,000 passenger profiles are marked "Not Included" (verified 2026-11-10).

The debtors named Google LLC as successful bidder at USD 10,000,000 and Mercor.io Corporation as alternate bidder at USD 7,500,000 (Dkt. 1463, 2026-08-14). The court had not approved the sale as of November 9, 2026, and a hearing is set for November 17, 2026. The ombudsman's supplemental report (Dkt. 1684, 2026-10-05) says approval of the de-identified data sale would be appropriate from a privacy perspective, and its footnote 3 states that risks to employees and third parties were not investigated. The definition of personally identifiable information in 11 U.S.C. 101(41A) covers consumer data only.

The objectors include AFA-CWA, ALPA, Allied Pilots Association, IAM and TWU Local 570, and the debtors' notice of adjournment of November 4, 2026 (Dkt. 1779) says they are working with the objecting parties on employee information. The wider rules are in US bankruptcy data sales.

Benefits, Risks, Downsides and Alternatives, Including Not Licensing Staff Communications

Licensing staff communications can bring license income, but it carries employee, regulatory and contractual risk that stays with the seller, and leaving them out is a valid choice.

Benefits

• Income from data the company already holds.
• A documented notice process that also serves later deals.
• Staff trust kept by telling first.

Risks

• Privacy claims that the seller indemnifies under buyer terms such as micro1 s.8.1.
• Regulator fines and damages, such as the CCPA amounts and the EUR 200 award above (2025-01-01 and 2025-05-08).
• Trained models that cannot be unlearned after an objection.
• A works council or union dispute, as in the Spirit case.

Downsides

• Works council timelines and deadlock routes such as the Einigungsstelle.
• Exclusions that shrink the dataset.
• Staff time for notice, objections and records.

Alternatives

• License only systems without personal staff content, such as code or documents, after the rights audit.
• De-identify to a stated standard first.
• License customer-facing records only.
• Not licensing at all.

Each path is compared under alternatives to selling data to AI labs.

Where Employee Notice Sits in the Seller Process

Employee notice is step 4 of the seller process, after the rights audit and alongside customer consent, and it comes before de-identification and valuation. The full route is described in how to sell or license company data to AI companies, in this order:

1. Data sale readiness
2. Rights audit
3. Company data that cannot be licensed
4. Customer consent, then employee notice (this page)
5. PII removal and de-identification
6. Should you sell or license your data

Staff Messages From a Closed or Insolvent Company

A closed company still owes its former staff the same notice, and the duty passes to whoever controls the data, such as a liquidator or trustee. The Italian Garante fined a company EUR 5,000 on 2026-04-17 for keeping a former employee's mailboxes active, and the German DSK resolution of 2024-09-11 says handing employee data to a bidder before signing is in principle not permitted without consent. Read selling data from a defunct company for the shutdown route; related pages cover employee data in bankruptcy data sales and the Spirit Airlines data archive sale.

Rules by Country, System and the Employee View

The detailed rules sit on these pages. This page is information, not legal advice.

• AI training data law by jurisdiction
• Employee data under GDPR Article 88
• Works council co-determination in Germany
• Works council consent in the Netherlands
• CSE consultation in France
• GDPR notices before a data sale
• Selling chat messages
• Licensing a company email archive
• The employee perspective on company data sales

Frequently Asked Questions

Do employees have to consent before company emails are licensed for AI training?

Not everywhere: in most cases the duty is to notify staff and have a legal basis, while consent or works council approval is required only where national law or a collective agreement says so. Germany and the Netherlands are examples.

Do you have to notify employees before a data sale?

Under the GDPR yes, before the disclosure (Article 13(3)), and the buyer must give its own notice within one month unless an exemption applies.

Can a company license employees' Slack direct messages?

Only if it can export them and has a basis to disclose them, and Slack's help page allows direct message export on Business+ only by application with Primary Owner approval, and on Enterprise via Support.