GDPR should in theory prohibit them from putting it for sale in the first place in a bankruptcy scenario, but if they are bound to disappear, there's no one to go after so idk...
I'm mentioning European regulations in a post about an American airline company just because you said any, and yeah, I'm bound to disagree there.
In any case, I already didn't trust any American company since they can be subpoenaed and they are bound by law to give all the data to the government, which looks as or more evil than the general evil American company rn.