Judge rules OPM broke federal privacy law over DOGE access

A federal judge has ruled that the Office of Personnel Management broke federal privacy law when it gave Department of Government Efficiency agents access to sensitive records about millions of current, former and prospective federal employees. Judge Denise Cote of the United States District Court for the Southern District of New York found that OPM violated the federal Privacy Act and set aside established cybersecurity practices when it granted DOGE agents access in early 2025. The ruling settles the central legal claims in the case, while a separate decision will address what remedy should follow and whether any retained copies of the data must be deleted.

The case was brought by the American Federation of Government Employees and other plaintiffs, who sued OPM in February 2025. They argued that agents who had not been properly vetted or trained received broad access to systems holding personally identifiable information. The plaintiffs said the records covered people who had no role in the work DOGE was doing, including current staff and former staff whose files remained in federal systems. Cote accepted the core of that account. She wrote that there was no meaningful dispute about the underlying conduct, and she noted that the government had focused largely on arguing that later events had made the case moot rather than defending the legality of the original access.

How federal privacy law applied to DOGE access

The Trump administration argued that DOGE agents were carrying out modernization work under the executive order that created the initiative. Cote rejected the argument that modernization required access to confidential employee data. She found that OPM disregarded safeguards that were already in place when it opened the systems to DOGE agents. The judge also said the disbanding of DOGE does not entirely remove the risk of future unlawful access, even though she credited OPM with efforts to strengthen its protocols during the litigation. In her account, the violations arose when individuals failed to follow the safeguards that existed at the time, and later improvements did not erase the earlier breach.

A preliminary injunction issued in June 2025 blocked DOGE agents from accessing the data while the case proceeded. OPM told the court that it began revoking access after the injunction. Government filings say no DOGE agent has had access to sensitive personnel information since September 2025. One former DOGE agent remains at OPM but, according to those filings, cannot access the data. Those later steps limited ongoing exposure, but they did not settle the question of whether the original grant of access was lawful. Cote ruled that it was not, and she left the remedy question open for a further ruling.

What federal privacy law leaves for the remedy decision

The plaintiffs are seeking the deletion or expungement of any OPM data copies that DOGE agents may still possess. That request goes to the practical effect of the disclosure, since a ruling that access was unlawful does not by itself remove copies that may have been made. F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which represents plaintiffs, said the court has now confirmed that OPM broke the law. He said OPM and DOGE should address the cybersecurity problems created by the disclosure. An OPM spokesperson declined to comment, citing the ongoing litigation. The White House and the Justice Department did not respond to requests for comment, according to the report of the ruling.

The case concerns the privacy and security of federal employees and their personal information. Records at issue included files on federal employees and former employees, and the ruling applies the Privacy Act to a personnel system that holds data on a large federal workforce. A separate Government Accountability Office review reported that many DOGE cost saving claims lacked supporting evidence or were incorrect, while another review found that information about agents and their activities remained unclear. Those reviews did not form part of the ruling, but they sit alongside the privacy case as part of the wider record on how DOGE operated inside federal agencies. For now, the legal position is clear in one respect: the original access was unlawful, and the court will next decide what must happen to any data that remains.