Politics
Federal judge finds OPM broke privacy law by giving DOGE access to employee records
A federal judge ruled that the Office of Personnel Management violated privacy law and bypassed security safeguards when it gave DOGE agents access to sensitive personnel data. The decision resolves the central legal claims, but a separate ruling will address whether any retained copies must be deleted.
The Office of Personnel Management unlawfully gave Department of Government Efficiency agents access to sensitive records about millions of current, former and prospective federal employees, a federal judge has ruled.
Judge Denise Cote of the U.S. District Court for the Southern District of New York found that OPM violated the federal Privacy Act and disregarded established cybersecurity practices when it granted DOGE agents access in early 2025.
The ruling confirms claims brought by the American Federation of Government Employees and other plaintiffs, who sued OPM in February 2025. They argued that agents who had not been properly vetted or trained received broad access to systems containing personally identifiable information.
The Trump administration argued that DOGE agents were carrying out modernization work under the executive order that created the initiative. Cote rejected the idea that modernization required access to confidential employee data.
“There is no meaningful dispute concerning the underlying conduct,” Cote wrote, noting that the government focused largely on arguing that later events had made the case moot rather than defending the legality of the original access.
A preliminary injunction issued in June 2025 blocked DOGE agents from accessing the data while the case proceeded. OPM told the court that it began revoking access after the injunction, and government filings say no DOGE agent has had access to sensitive personnel information since September 2025. One former DOGE agent remains at OPM but, according to those filings, cannot access the data.
Cote said DOGE’s disbanding does not entirely remove the risk of future unlawful access. She also credited OPM’s efforts to strengthen its protocols during the litigation, while emphasizing that the violations arose when individuals failed to follow the safeguards already in place.
The ruling settles the case’s central legal questions, but the judge will decide separately what remedies are appropriate. The plaintiffs are seeking the deletion or expungement of any OPM data copies that DOGE agents may still possess.
“The court has now confirmed” that OPM broke the law, said F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which represents plaintiffs. He said OPM and DOGE should address the cybersecurity problems created by the disclosure.
An OPM spokesperson declined to comment, citing the ongoing litigation. The White House and Justice Department did not respond to requests for comment.
The case concerns the privacy and security of federal workers’ personal information, including the records of employees and former employees who had no role in DOGE’s work. A separate Government Accountability Office review reported that many DOGE cost-saving claims lacked supporting evidence or were incorrect, while another found that information about agents’ identities and activities remained unclear.