Victory! Court Rules OPM's Disclosure of Personal Records to DOGE is Unlawful
Original reporting by Electronic Frontier Foundation
The Office of Personnel Management (OPM) has been found in violation of federal law for unlawfully disclosing millions of federal employee records. In a significant victory for data privacy, a federal court in New York issued a summary judgment on October 20, 2026, definitively ruling that OPM violated the Privacy Act. The court found OPM breached two key provisions: one restricting disclosure of personal records between agencies and another mandating agencies protect record security and confidentiality. This decision stems from OPM's disclosure of highly sensitive personally identifiable information (PII) belonging to tens of millions of federal employees, retirees, and job applicants to agents of the U.S. DOGE Service, led by Elon Musk, beginning in January 2025.
The privacy stakes
The federal Privacy Act of 1974 is a critical anti-surveillance statute designed to prevent government abuse of personal information, making OPM's actions a direct challenge to its protections. The Electronic Frontier Foundation (EFF), representing federal employee unions and individual employees, filed the lawsuit, arguing that OPM's broad grant of access to DOGE agents was unlawful. While many DOGE agents have since left government and OPM has rescinded database access, the court's ruling underscores the agency's responsibility to rectify the cybersecurity vulnerabilities it created. The specific remedies OPM must undertake will be determined at a later date, but the judgment firmly establishes the illegality of its data-sharing practices.
The federal court's decisive ruling against the Office of Personnel Management marks a significant victory for data privacy and federal employee protections. By unequivocally declaring OPM's disclosure of millions of sensitive records to DOGE agents unlawful under the Privacy Act, the judgment reinforces a foundational principle: government agencies are not exempt from stringent rules governing personal data. This outcome serves as a powerful validation of the 1974 Privacy Act’s intent as a bulwark against unchecked federal surveillance and arbitrary information sharing. The court's finding, particularly Judge Cote's assertion that the disclosure lacked justification, underscores the critical need for agencies to adhere strictly to legal frameworks, rather than improvising data access protocols. While OPM has already rescinded DOGE's access, the forthcoming remedy phase will be crucial in mandating a thorough cleanup of the cybersecurity vulnerabilities created.
Broader Implications Unfold
Beyond OPM, this landmark decision carries profound implications for the entire federal government's approach to data stewardship. It establishes a robust precedent that is likely to compel all agencies managing vast databases of Personally Identifiable Information (PII) to rigorously reassess their data sharing agreements, access controls, and cybersecurity measures. The ruling sends a clear message that convenience or alleged modernization efforts cannot supersede legal mandates designed to protect citizens' privacy. In an era increasingly defined by large-scale data aggregation and the rise of advanced AI systems, this judgment underscores the imperative for transparent, legally compliant, and secure data handling practices within public institutions. It reinforces public trust by demonstrating that legal recourse exists to hold government entities accountable, potentially shaping future legislative discussions on data governance and privacy in the digital age.
Frequently asked questions
- What federal law did OPM violate by disclosing employee data to the DOGE Service?
- The Office of Personnel Management (OPM) violated the Privacy Act of 1974. This landmark statute prohibits federal agencies from abusing personal information. Specifically, OPM breached two provisions: one restricting the disclosure of personal records between agencies and another mandating agencies to safeguard the security and confidentiality of those records. This ruling impacts the sensitive personally identifiable information (PII) OPM manages for millions of federal employees.
- What are the implications for OPM following the federal court's data privacy violation ruling?
- A federal court definitively ruled that OPM unlawfully disclosed millions of federal employee records to DOGE agents. Although DOGE agents have since left government and OPM rescinded their database access, the court will determine specific remedies at a later date. This decision holds OPM accountable for the cybersecurity lapses and data management practices that led to the Privacy Act violations, requiring future actions to protect sensitive employee information.
- Which organizations sued OPM over the unauthorized disclosure of federal employee personal data?
- The Electronic Frontier Foundation (EFF) led the lawsuit against OPM and the U.S. DOGE Service. They were joined by co-counsel including Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC. The EFF represented unions of federal employees, such as the American Federation of Government Employees and the Association of Administrative Law Judges, alongside individual employees, seeking injunctive and declaratory relief for the data privacy violations.