A Judge Rules OPM Broke the Privacy Act in Opening Personnel Records to DOGE. The Remedy Comes Later.

Bottom line

On January 20, 2025, people working on the DOGE agenda began receiving access to at least fourteen OPM systems, most of them holding personal information on current, former and prospective federal employees ^[1]. On Tuesday, Judge Denise Cote of the Southern District of New York ruled that those grants violated the Privacy Act ^[1]. The access was revoked long ago. The court has not yet said what OPM must do about it ^[1].

What happened

The ruling. The October 20 opinion resolves cross-motions for summary judgment in a case filed February 11, 2025 by current and former federal employees and their unions ^[1]. The Electronic Frontier Foundation, which represents them, says the plaintiffs include the American Federation of Government Employees and the Association of Administrative Law Judges ^[4]. The court granted the plaintiffs’ motion on their Administrative Procedure Act claims and granted the government’s motion on a separate ultra vires claim against the DOGE defendants, finding the APA already gave the plaintiffs a route to relief ^[1].

The opinion is brief on the merits. “At this point, there is no meaningful dispute concerning the underlying conduct,” Judge Cote wrote, adding that the government “barely” defended its legality ^[1]. She adopted the reasoning of her June 9, 2025 preliminary injunction opinion: OPM disclosed records to people who were not OPM employees or had no need for them in their duties, in breach of 5 U.S.C. 552a(b), and it set aside its own safeguards, in breach of 552a(e)(10) ^[1].

The record. According to OPM’s March 2025 audit, twenty DOGE-related individuals were granted access between January 20 and March 6, 2025, almost all of it administrative ^[1]. Few of them ever logged in ^[1]. OPM’s then-acting director and chief information officer said access was granted in case it might be needed; the CIO also testified that a request for access can be met within minutes ^[1]. Many DOGE Agents acknowledged OPM’s cybersecurity and privacy training weeks after they already had access ^[1]. Meanwhile, career database administrators in OPM’s IT office lost their own access on or shortly after January 20 ^[1].

The government’s main defense was the executive order. EO 14158 tells agency heads to give the U.S. DOGE Service “full and prompt access to all unclassified agency records, software systems, and IT systems,” to “the maximum extent consistent with law” ^[2]. The court was not persuaded. It repeated its earlier finding that IT modernization “does not necessarily require access to confidential PII” and noted testimony from a former OPM deputy CIO who had worked on modernization at two agencies without touching personal data in the systems involved ^[1]. A late argument based on OPM’s organic statute was rejected as a post hoc rationalization ^[1].

Why the case was not moot. Much has changed since the injunction. No DOGE Agent has had access to OPM systems containing personal information since September 2025 ^[1]. Of the eight still at OPM in June 2025, one remains: Noah Peters, a senior advisor in the director’s office, whose status as an OPM employee or USDS detailee is disputed ^[1]. He completed OPM’s cybersecurity training on April 5, 2026 ^[1]. The DOGE Temporary Organization ended on July 4, 2026, the date fixed in the order ^{[1, 2]}.

The court still found a live dispute. OPM continues to maintain that every DOGE Agent who received access was an employee with a need for it ^[1]. The court also observed that OPM removed permissions shortly before reports were due and revised its policies close to litigation deadlines ^[1]. The temporary organization’s end narrows the risk but does not remove it, the court wrote, because USDS still operates inside the Executive Office of the President and the order’s access directive remains in effect ^{[1, 2]}.

What it means for you

Employees, retirees and applicants. If your records sit in OPM systems, the court has now held that opening them to DOGE Agents without a demonstrated need was unlawful ^[1]. Readers should be precise about what that holding does and does not do. It is a ruling on the agency’s conduct. It is not a damages award: the plaintiffs asked for injunctive and declaratory relief, and the court dismissed their standalone Privacy Act claims in April 2025 except as the basis for the APA claims ^{[1, 4]}. Because the permissions were already rescinded, the court said they need not be set aside ^[1].

On the question most readers will ask, whether data left OPM, the record holds one answer, and it comes from OPM. Its IT office reviewed audit logs, account records and data-loss and export logs from January 20, 2025 through June 5, 2026 and reported no evidence that DOGE Agents exported, copied or transmitted records containing the plaintiffs’ personal information outside OPM systems ^[1]. OPM concluded no remediation was needed ^[1]. The plaintiffs have not accepted that and are still seeking deletion of any copies ^[3].

What the plaintiffs want next. Their requested relief includes ^[1]:

• a bar on OPM disclosing records to employees under a “need to be prepared” rationale, and to DOGE or its agents under the Privacy Act’s need-to-know exception;
• removal of any DOGE access to OPM records, including copies moved elsewhere, with deletion by anyone holding them;
• an accounting of disclosures to DOGE Agents under 5 U.S.C. 552a(c)(1), and a plan to mitigate the effects;
• attorney’s fees.

The court has not granted any of it yet. It said the preliminary injunction does not settle whether a permanent one is warranted, and that OPM’s changes in practice will weigh in that decision even though they did not moot the case ^[1].

OPM staff and contractors. OPM’s May 11, 2026 policy, sent to all OPM employees on May 15, now limits access to systems with personal information to OPM employees and contractors, and excludes detailees ^[1]. Before access is granted, the system owner must confirm training, appointment, vetting and written approval from OPM’s senior agency official for privacy, and the policy reaches indirect requests routed through other staff ^[1]. OPM’s current CIO, Adam Starr, has disavowed the “need-to-be-prepared” rationale for any kind of access ^[1]. The protocols apply to new contractors as well as new employees ^[1].

• Whether the court will order the accounting of disclosures, which is the closest thing to a record of who saw what ^[1].
• Whether the government will appeal. It renewed its standing, reviewability and mootness arguments in its summary judgment papers to preserve them for appeal ^[1].
• Whether Peters was an OPM employee or a USDS detailee in early 2025. The court did not need to decide it ^[1].

OPM declined to comment on the ruling ^[3]. The Electronic Frontier Foundation’s F. Mario Trujillo said OPM and DOGE “owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created” ^[3].

Questions you’re probably asking

Did the court rule that OPM illegally gave DOGE access to federal employee records?

Yes. Judge Cote held that OPM’s broad grants of access to systems containing personal information, made without a demonstrated need, violated 5 U.S.C. 552a(b) and (e)(10) and were therefore unlawful under the APA ^[1].

Will federal employees get money from the OPM DOGE lawsuit?

Not from this case as it stands. The plaintiffs sought injunctive and declaratory relief, and the court dismissed their freestanding Privacy Act claims in April 2025 except as a basis for the APA claims ^{[1, 4]}.

Was my OPM data copied or sent outside OPM?

OPM says its internal review, covering January 20, 2025 through June 5, 2026, found no evidence that DOGE Agents exported or transmitted records outside OPM systems ^[1]. The plaintiffs are still asking the court to order deletion of any copies that exist ^[3].

Does DOGE still have access to OPM personnel systems?

No DOGE Agent has had access to OPM systems containing personal information since September 2025, according to the government ^[1]. One, Noah Peters, still works at OPM without such access ^[1].

Do federal employees need to do anything after the ruling?

The opinion places no duties on individual employees or retirees ^[1]. What OPM must do, if anything, waits on the court’s separate decision about relief ^{[1, 3]}.

What I’m watching

• No date set: the court’s decision on relief. Judge Cote said she will ask the parties for their views on what relief, if any, is appropriate ^{[1, 3]}.
• No date set: any notice of appeal once relief is decided ^[1].