News and analysis
Employee Privacy When Companies Sell Data to AI
Employees can object to a license of workplace messages even after names are removed. Critics argue the messages are still about identifiable people. Research has re-identified people in other sparse datasets. A careful notice says in advance what a license would exclude, and it does not call the copy anonymous. Whether the license is lawful is a separate legal question.
| Fact | Detail |
|---|---|
| Critic | Marc Rotenberg, reported by Forbes on April 16, 2026, on identifiable people in workplace messages. Forbes |
| Recital 26 | Identifiability depends on means reasonably likely to be used, including cost, time, and technology. EUR-Lex |
| Nature Communications, 2019 | Demographic and similar population attributes, not Slack or email archives. Nature Communications |
| Netflix Prize paper | Movie-rating records, not company email. arXiv |
Whether a license is lawful
Whether a company may license its records is a legal question, answered on is it legal to sell company data to AI companies.
Taking names off a file is not the same thing as falling outside privacy law. Recital 26 asks whether identification is reasonably likely, given cost, time, and the technology at hand, including means another person might use. Critics are pointing at that test when they say a message can still be about an identifiable person. The test is not a ruling that your deal is lawful. Ask your lawyer about your records before you treat a removal step as the end of the question.
What critics say
The objection is not that a database exists. It is that workplace messages are about identifiable people.
Forbes reported on April 16, 2026 that Marc Rotenberg said, "I think the privacy issues here are quite substantial." He said, "Employee privacy remains a key concern, particularly because people have become so dependent on these new internal messaging tools like Slack." He said, "It's not generic data. It's identifiable people." Rotenberg is founder of the Center for AI and Digital Policy. He also ties the worry to Slack, because so much daily work now sits in internal messaging tools. Employees, he argues, are unlikely to expect those messages to be sold to a third party, even if they signed intellectual-property terms. If your notice says they should have expected it, you are arguing with that expectation. Say what the contract actually does.
A second voice in the same article is Bobby Samuels of Protege. Forbes reported that he said, "If anonymization's not done correctly, there are risks that companies who have access to the data would be able to see the activities of individual organizations and people, and then if not treated carefully, could leak into model output." That is a practitioner's warning about a bad process. It is not a claim that every removal fails. It is a claim that a sloppy one can leave people visible, and that visibility can show up later in a model's output.
Hold both remarks as objections, not as a verdict. Rotenberg's point is expectation and identifiability. Samuels's point is residual risk when a removal is done poorly. Neither remark measures your archive. Be ready to answer both before you tell staff the file is safe. Union objections in one airline bankruptcy are explained in Spirit Airlines data auction.
What removing names does not do
Under the recital, the question is whether identification is reasonably likely, not whether the name column is empty.
Recital 26 of Regulation (EU) 2016/679 says that to determine whether a person is identifiable, account should be taken of all the means reasonably likely to be used, such as singling out, either by the controller or by another person. It also says to weigh the costs of and the amount of time required for identification, and the technology available at the time of the processing and technological developments. Read that as a test you can apply to a file, not as a slogan. Cost counts. Time counts. Technology available now, and technology that is developing, counts. The means can be the company's own, or someone else's. An export with the names removed can still be about an identifiable employee if other details make that person reasonably easy to pick out. Before you tell staff the file is safe, run that test against a real thread, not against an empty name column.
Pseudonymization is processing that stops data from being attributed to a person without extra information, kept separately. The recital treats data that has gone through that process, and that could still be tied to a person with the extra information, as information on an identifiable person. Ask a buyer where that extra information is kept. It is one of the questions to ask before selling company data. Removing the name column does not close the question.
De-identification is a process label: personal details are removed or masked. A process that carries that label is not, by the label alone, the recital's category of information that no longer relates to an identifiable person. Calling the step by a careful name does not answer the means test. The test is still whether identification is reasonably likely.
What the research measured
These papers are reasons to doubt a casual claim that a sparse dataset cannot be tied back to a person. They are not a measurement of any company's Slack export.
| Study | What it measured | What it did not measure | Source |
|---|---|---|---|
| Rocher, Hendrickx, and de Montjoye, Nature Communications, July 23, 2019 | Rocher, Hendrickx, and de Montjoye, in Nature Communications on July 23, 2019, propose a method that estimates the likelihood a specific person is correctly re-identified, even in a heavily incomplete dataset. The abstract states: "Using our model, we find that 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes." The paper describes its subject as medical, behavioral, and socio-demographic data, and the abstract's 15-attribute result uses demographic attributes. | Demographic and similar population attributes, not Slack or email archives. | Nature Communications |
| Narayanan and Shmatikov, Netflix Prize dataset | Narayanan and Shmatikov describe a de-anonymization attack on large sparse datasets and apply it to the Netflix Prize dataset of movie ratings. The paper's case study is the Netflix Prize dataset, which it describes as movie ratings, and the paper dates Netflix's contest announcement to October 2, 2006. | Movie-rating records, not company email. | arXiv |
The Nature result is about demographic attributes in population data. Fifteen attributes, in the abstract's own wording, describe a person in a census-style file. Workplace chat is not that file. Use the result as a warning about sparse records in general. Do not read it as a percentage for your Slack export. If a buyer quotes 99.98 percent at your messages, they are moving a population result onto a record the study did not measure. Ask what they measured in a file like yours.
The Netflix paper shows that a little background knowledge can pick a subscriber's record out of a large sparse set of movie ratings. Ratings of films are not company email. Sparse records can still be distinctive, and that is the lesson to carry into a workplace archive. The paper does not give you a rate for your mail.
Forbes reported that SimpleClosure removes all personally identifiable information from internal company data, and that the firm wanted that process solid before a wider rollout. That is SimpleClosure's account of its own process. A claim that personally identifiable information is removed is not a demonstration that Recital 26's test is met. The recital still asks about means reasonably likely to be used, including by another person. A licensed copy leaves out names, emails and phone numbers, and customer and staff details. The full list of what a license leaves out is on what is shared. Naming those categories is not a method, and it is not a finding that the recital's test is met. Match the notice to the contract. If the contract excludes less than the sentence you want to say, say less.
What staff can be told in advance
The fair version of the announcement matches the contract and does not use the word anonymous.
Say whether a license is being considered. Say what is excluded, in the same words the contract uses. Say who will answer questions. A stronger word than the contract uses will not survive a comparison with the contract.
If the agreement excludes names, emails and phone numbers, and customer and staff details, you can say those words. If the agreement excludes more, say the more. If it excludes less, do not add a comfort the contract does not give. Staff can compare the note with the document. The note should survive that comparison. Do not call the copy anonymous. The objection you are answering is that the messages are still identifiable people.
Telling people the company is closing is a different conversation. Read how to tell employees the company is closing for that meeting. The license notice is about records. The closure meeting is about jobs, dates, and what happens next at work. Do not fold one script into the other. A person can hear both, on different days, without one sentence trying to do both jobs.
What to decide before anyone signs
An objection tells you what staff may say. It does not choose the contract. Decide the commercial question, the legal question, and the notice as three separate jobs.
For the reason the April 2026 articles give for wanting workplace archives, read why AI companies buy Slack and email data. That reporting is about why the archives are discussed. The objection and the studies are about whether people can still be identified. Ask any buyer, including us, how a person could still be singled out after names are removed.
If you are deciding whether to license records at all, start with how to sell company data to AI companies. A careful notice names the exclusions the contract actually uses. Eligibility is a separate check. An objection does not start an application, and it does not submit your records.
General information only. This is not legal, tax or financial advice.
Related
- Why AI companies buy Slack and email data
What public reporting and lab posts actually say about workplace archives and agent training environments.
- What's shared
Which records can be licensed, which details never leave, and what you approve.
- How to tell employees the company is closing
The order for telling staff: federal WARN notice, the meeting, a script outline, final pay, and health coverage.
- How to sell company data
How to sell or license company data to AI companies, and which route fits.
Questions about employee privacy and data sales
Why do critics say removing names from employee messages is not enough?
Forbes reported that Marc Rotenberg said, "I think the privacy issues here are quite substantial," and, "It's not generic data. It's identifiable people." He tied the concern to tools such as Slack. Recital 26 asks whether a person is identifiable by means reasonably likely to be used, including by another person, given cost, time, and available technology. An empty name column does not answer that test. The messages can still be about a person a reader could pick out.
What did the 2019 Nature Communications paper actually measure?
Rocher, Hendrickx, and de Montjoye estimated how likely it is that a specific person is correctly re-identified in an incomplete dataset. The paper's subject is medical, behavioral, and socio-demographic data. The abstract says 99.98% of Americans would be correctly re-identified in any dataset using 15 demographic attributes. That figure is about population attributes. The study did not measure a Slack export or an email archive.
Are workplace messages with staff names removed still about identifiable employees?
They can be. Recital 26 treats data that has gone through pseudonymization, and that could still be tied to a person with extra information, as information on an identifiable person. Removing names does not settle whether identification is reasonably likely. Cost, time, and technology, including means another person might use, are part of the test. Ask your lawyer how that test applies to your records, and ask a buyer where any extra information is kept.
What can a company publish in advance so staff are not surprised?
Say whether a license is being considered. Say what the contract excludes, in the same words the contract uses. Say who will answer questions. Do not call the copy anonymous. A licensed copy leaves out names, emails and phone numbers, and customer and staff details. Use those categories in the note only when the contract uses them. If the contract excludes less, do not add a comfort it does not give. The meeting about jobs and closing dates is a different conversation from the license notice.
Where is the legal analysis, as opposed to the privacy objections?
Whether selling company data to AI companies is legal depends on the statutes, contracts, and people that apply to your records. A critic's objection, a re-identification study, and a staff notice do not settle that question. They tell you what employees may object to and what you can say before anyone signs. Ask your lawyer to apply the law to your files. Lawfulness and the privacy objection are different decisions, and only your lawyer can close the first one.
Sources
- Forbes. AI's New Training Data: Your Old Work Slacks And Emails.
- EUR-Lex. Regulation (EU) 2016/679, Recital 26.
- Nature Communications. Estimating the success of re-identifications in incomplete datasets using generative models.
- arXiv. Robust De-anonymization of Large Datasets (How to Break Anonymity of the Netflix Prize Dataset).