New York court finds OPM violated Privacy Act by disclosing records to DOGE

A New York federal court granted summary judgment on October 20, 2026, ruling that the Office of Personnel Management violated the Privacy Act by disclosing millions of federal employee records to DOGE agents.

The court found OPM violated two Privacy Act provisions. One limits sharing personal records across agencies. The other requires agencies to keep those records secure and confidential.

The Electronic Frontier Foundation sued OPM and DOGE in the U.S. District Court for the Southern District of New York in February 2025 on behalf of the American Federation of Government Employees, the Association of Administrative Law Judges, and individual employees. The lawsuit alleged that OPM, then led by acting Director Charles Ezell, shared personnel records with DOGE agents in breach of the Administrative Procedure Act and the Privacy Act of 1974.

EFF seeks injunctive and declaratory relief, and its co-counsel are Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC. The suit asks the court to stop any future release of OPM data to DOGE and to erase information OPM already gave to DOGE.

OPM began sharing data with the U.S. DOGE Service in January 2025, when Elon Musk initially led the operation. The agency keeps databases holding highly sensitive personal details for tens of millions of federal employees, retirees, and job applicants.

U.S. District Judge Denise Cote granted a preliminary injunction finding OPM erred by giving DOGE agents wide access to its systems. Judge Cote said the decision broke with the agency’s Privacy Act duties and longstanding cybersecurity practices. She wrote that the decision to give DOGE agents wide access to systems containing personally identifiable information was unlawful.

Many DOGE agents have left the government since the case was filed, and OPM has taken back their database access. No remedy has been set yet, and the court will settle that question later.

Under the Privacy Act, agencies generally may not share personal records unless the person consents or a specific legal exception applies. The law also lets individuals sue for actual damages when agencies violate it, and courts can order agencies to fix records or change how they operate.

The New York decision creates a precedent for other pending cases that challenge DOGE requests for data at the Defense Department, the Social Security Administration, and the IRS. At least three such lawsuits are underway. DOGE began in early 2025. Since then, the collective has sought access to personnel files, contractor records, and other sensitive government data while working to find waste and inefficiency across federal agencies.

EPIC, Democracy Forward, and the Kaplan Law Firm brought a separate case in February 2025 for an unnamed former federal employee, challenging DOGE’s ability to reach OPM and Treasury databases holding personal details on tens of millions of people. The U.S. District Court for the Eastern District of Virginia turned down the Trump administration’s request to dismiss the case in an order dated Wednesday, letting the lawsuit proceed. The administration’s request to dismiss argued the plaintiffs lacked standing and did not state a valid claim.

The Treasury Department’s Bureau of the Fiscal Service runs payment systems holding Social Security numbers, taxpayer identification numbers, home addresses, and other personal data for tens of millions of people. The complaint says career staffers who tried to block DOGE’s access lost access, workers who objected lost their jobs, and representatives for Musk received complete access to government payment systems.

Those sued in Virginia include DOGE, Treasury under Secretary Scott Bessent, and OPM with then-acting Director Charles Ezell. DOGE is described as a defunct tech collective that Elon Musk launched at the start of the second Trump administration. It reached data kept by the Treasury Bureau of Fiscal Service and by OPM. That reach exposed information belonging to nearly every federal employee and millions of additional people.

Senators Elizabeth Warren of Massachusetts and Ron Wyden of Oregon, both Democrats, wrote to Secretary Bessent seeking information on what the department is doing to fix the breach and stop it from happening again. Lawmakers in Congress continue to seek answers about what information DOGE obtained and how Treasury has handled the situation.

On February 24, 2025, the U.S. District Court for the District of Maryland ordered the Department of Education and OPM to stop sharing sensitive personal details with DOGE-linked staff. That order runs until March 10, 2025 and bars the Education Department from giving personally identifiable information to any DOGE associate. It also blocks OPM from sharing personally identifiable information with OPM staff focused mainly on the DOGE agenda, except for OPM Chief Information Officer Greg Hogan.

The court said no to the plaintiffs’ request for relief against the Treasury Department, pointing out that an earlier injunction in a different case already shields the plaintiffs from Treasury. Judge Deborah L. Boardman found that the plaintiffs would suffer serious harm unless a court ordered a stop to the continuing unauthorized release of sensitive personal details to DOGE affiliates. “This is just one of the many unwarranted attacks that federal employees have faced over the past month,” said Randy Erwin, national president of NFFE-IAM.