Federal Court Rules OPM Illegally Shared Employee Data With DOGE Agents
A New York judge declared that the Office of Personnel Management violated privacy laws by granting broad access to sensitive records.
Key points
- The court ruled OPM violated two Privacy Act provisions regarding inter-agency disclosure and record security.
- OPM provided data to the U.S. DOGE Service starting in January 2025, led by Elon Musk.
- Database access for DOGE agents has been rescinded, though legal remedies remain pending.
A federal judge in New York declared on October 20, 2026, that the Office of Personnel Management acted unlawfully by sharing millions of federal employee records with agents from the U.S. DOGE Service. The summary judgment ruling found that the personnel agency breached two specific provisions of the federal Privacy Act of 1974 during this data exchange.
Judge Denise Cote wrote that the decision to grant sweeping access to personally identifiable information was unlawful. The court record showed no evidence that a modernization agenda justified the expedited sharing of these sensitive databases with a large group of external agents. The ruling addresses the core legality of the disclosure itself.
Legal Violations and Timeline
The Office of Personnel Management maintains extensive databases containing highly sensitive personal information about tens of millions of federal employees, retirees, and job applicants. Starting in January 2025, OPM disclosed this data to the U.S. DOGE Service, an initiative led by Elon Musk. The court determined this action violated the statute that restricts the disclosure of personal records between government agencies.
Additionally, the agency failed to meet the Privacy Act requirement to protect the security and confidentiality of these records. The Electronic Frontier Foundation highlighted that the Privacy Act serves as a critical anti-surveillance statute designed to prevent the federal government from abusing personal information. The court’s finding confirms that the data sharing lacked proper legal footing.
Litigation and Current Status
The Electronic Frontier Foundation filed the lawsuit on behalf of federal employee unions and individual workers. The EFF represents the American Federation of Government Employees and the Association of Administrative Law Judges in this case. Co-counsel for the plaintiffs include Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm LLC.
The case was filed in the U.S. District Court for the Southern District of New York. The plaintiffs sought injunctive and declaratory relief to stop the unlawful data practices. According to the EFF, the litigation was necessary because the disclosure directly violated established privacy protections. The court will determine the appropriate legal remedy at a later date.
Since the lawsuit was filed, many DOGE agents have left the government, and OPM has rescinded their access to the databases. However, the Electronic Frontier Foundation noted that OPM still needs to address the cybersecurity issues created by the initial breach of protocol. The ruling stands as a definitive legal conclusion on the unlawfulness of the access grant.
What should you do?
Security professionals should monitor for any follow-up disclosures or data remnants from this incident. Federal employees should review their personal data exposure through official channels. Agencies should audit their current data-sharing agreements to ensure compliance with the Privacy Act. Organizations should prepare for potential remediation efforts mandated by the court.
What to do and how to stay safe: OPM
- Review internal data-sharing policies to ensure they align with Privacy Act requirements for inter-agency disclosures.
- Audit access logs for any unauthorized or excessive access to systems containing personally identifiable information.
- Monitor official government channels for updates on remediation steps or further legal developments regarding this case.
- Verify that current database permissions follow the principle of least privilege for all external agents or contractors.
Step-by-step guide: How to Remove Data from Data Brokers: The Manual Cleanup Process
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did the court rule that the data sharing was legal?
No, the federal court ruled that OPM violated the Privacy Act by disclosing records to DOGE agents.
Which organizations filed the lawsuit?
The Electronic Frontier Foundation filed the suit representing federal employee unions and individual workers.
Has OPM stopped sharing data with DOGE?
Yes, OPM has rescinded database access for DOGE agents since the case was filed.
