Judge rules DOGE access to federal data was unlawful

A federal judge has ruled that the Office of Personnel Management broke federal law when it gave the Elon Musk-led Department of Government Efficiency broad access to sensitive government data, according to a report in Fortune. In a 39-page ruling, Judge Denise Cote said the sharing violated the Privacy Act of 1974 and that the agency also failed to follow its own cybersecurity practices. The case centred on DOGE data access to records holding personally identifiable information for tens of millions of federal employees, job applicants and retirees. Cote said the government had not given a credible reason why that access was needed, and she rejected the argument that later events had made the dispute go away.

"The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary," Cote wrote in the ruling, as quoted by Fortune. The judge still reached conclusions on the merits of the claims, even though the access permissions had by then been rescinded. Because those permissions no longer stood, the ruling said they did not need to be set aside. That distinction matters for how the decision is read: it is a finding that the earlier grant of access was unlawful, paired with a narrower form of relief because the DOGE data access itself had ended.

Why the DOGE data access was ruled unlawful

The Privacy Act is a post-Watergate law that restricts the disclosure of certain records and sets out requirements for safeguarding others, according to the Fortune report. Cote found that the agency had breached those rules when it opened its systems holding government data to DOGE agents without a demonstrated need for the personal information held there. The ruling also found that the agency had disobeyed its own cybersecurity practices in the way the access was given.

The Department of Justice acted for the Office of Personnel Management in the case. Its lawyers had argued that DOGE agents needed access to employee records, background checks, medical files and banking information as part of work to modernise the federal workforce. Cote rejected that explanation. She said earlier government modernisation efforts had not required access to information of that kind, and she said the administration had never made a connection between the data and the responsibilities DOGE agents were meant to carry out. In her view, a broad claim about modernisation, without a link to specific work, did not explain why the DOGE data access to personal records was needed.

What the DOGE data access covered

The records at issue held personally identifiable information for tens of millions of federal employees, along with applicants and retirees. That scale is part of why the case drew attention: the information was not a small set of administrative files, but material tied to the working lives and personal histories of a large group of people connected to the federal workforce. The ruling treated the breadth of the DOGE data access as relevant, because the government had to show a need that matched what it had opened up. Cote found that it had not done so, and the DOGE data access therefore lacked the justification the law required.

DOGE was assembled by Musk in the first days of President Donald Trump's second term, with the stated aim of rooting out waste, fraud and abuse in the federal government. The group has claimed savings of $215 billion from cancelled contracts and a reduction of about 300,000 government workers, according to the Fortune report. Those are DOGE's own figures. Former federal employees, including former IRS acting Commissioner Douglas O'Donnell, have warned that the sweeping cuts will have lasting effects on the government's ability to improve efficiency through updated technology.

What the DOGE data access ruling leaves open

One question the ruling does not settle by itself is how future DOGE data access requests will be handled, since the decision turned on the facts of this grant of access and the absence of a demonstrated need for it. Future sharing will still need a specific need and proper safeguards. The ruling also leaves in place the finding that the earlier permissions were unlawful, even though the permissions themselves had been rescinded and did not need to be set aside. The decision records a legal limit on how far a modernisation claim can stretch.