In a market-first values system, where we rely on the labor market to largely self-regulate given the promises that free market idealogues & corporate actors made us, colluding on wages like this should lead to scorched-earth retribution from the FTC.

Not "Oh hey there, you're not allowed to do that, stop that", but "We are diluting your stock by a quarter and distributing it to your workers" type shit.

Does my personal health information belong to my doctor? Not according to HIPAA, at least not in a way that gives the doctor control over selling it. While my pay is currently not protected by similar regulation, it seems like the kind of protection regulation similar to HIPAA could defensibly target.

Most companies request people not share pay information. Information asymmetry is a huge deal in negotiations.

Well, if we're discussing whose data it is the information about how much I pay you, even from a devi's advocate perspective, you can't do better than arguing that this data pertains to both of us. So we should share the property of that data somehow. I don't see how you could argue that that data would be solely the employer's data.

... should companies be nervous about this also though? Is the decision for their payroll info to be visible to unknown buyers an intentional, well-considered one? Is this effectively leaking potentially strategically important info?

Like, I haven't seen this happen, but could a recruiting team buy the compensation data on staff at a competing firm, identify those that look like a good deal, and poach them starting with a "we'll offer you k% more than your current employer"?

Could market analysts use this data to notice when a company starts firing more people, or starts giving fewer/smaller raises? What if the next time your company showed up in a Gartner or Forrester report, it came along with a caveat "however given decreased investment in staff, their pace of product development or quality of client services may be at risk."

The employer requires this data to do payroll correctly. Apart from that, it sound only be used for expressly authorized purposes. But maybe that's a european GDPR-influenced way of seeing this issue.