Judge Rules OPM Broke Privacy Law by Giving DOGE Access to Federal Worker Records

A federal judge in New York ruled on Tuesday that the Office of Personnel Management broke federal privacy law when it granted the Department of Government Efficiency broad access to sensitive personnel records.

US District Judge Denise Cote issued the summary judgment ruling on Oct. 20 in AFGE v. OPM, a case brought by a group of plaintiffs led by the American Federation of Government Employees. The court found that OPM violated two provisions of the Privacy Act, one restricting the disclosure of personal records and another requiring agencies to protect the security and confidentiality of the records they hold, according to the Electronic Frontier Foundation, which represented plaintiffs in the case.

What the judge found

Bloomberg Law reported that Cote found there was no meaningful dispute that OPM violated the Privacy Act by allowing DOGE agents access to sensitive personal information. She had already blocked that access in a June 2025 order.

"The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary," Cote wrote, according to Bloomberg Law.

Cote said the misconduct stemmed from the failures of particular individuals to abide by the Privacy Act and OPM safeguards. "The effectiveness of any law and such government safeguards ultimately depends on the fidelity of those entrusted to observe and enforce them, and even the most rigorous procedures cannot secure compliance by those willing to disregard them," she wrote.

The plaintiffs also prevailed on their claims under the Administrative Procedure Act because of the privacy violations, Bloomberg Law reported.

Records on tens of millions

OPM holds databases with highly sensitive personal information on tens of millions of federal employees, retirees and job applicants. Starting in January 2025, OPM disclosed records to the US DOGE Service, the cost cutting effort led by Elon Musk, according to the EFF.

"By virtue of the Court's summary judgment ruling, OPM's decision to grant DOGE Agents broad access to its systems of records containing personally identifiable information has been held unlawful," Cote wrote, according to the EFF.

The EFF said the court also found no support for the idea that a modernization agenda prompted OPM to grant sweeping and expedited access to about a score of DOGE agents.

What happens next

The ruling does not settle what happens now. Cote said changes since her June 2025 order were not enough to make the case moot, but they raise significant questions about what relief, if any, is necessary, according to Bloomberg Law.

DOGE has been dissolved, only one of its agents is still at OPM, and no DOGE agent has accessed sensitive OPM data since September 2025, the judge noted. The EFF said many DOGE agents have left the government and OPM has rescinded their database access, and that the court will decide the remedy at a later date.

The plaintiffs sued in February 2025. They were represented by the Democracy Defenders Fund, Lex Lumina LLP, the Electronic Frontier Foundation and the Chandra Law Firm LLC, according to Bloomberg Law. Government lawyers represented the Trump administration.