Federal Judge Rules OPM Violated the Privacy Act by Giving DOGE Access to Employee Records
A federal court has ruled that OPM violated the Privacy Act when it gave DOGE agents broad access to the personal information of tens of millions of past, current, and aspiring federal employees. Judge Denise Cote of the U.S. District Court for the Southern District of New York issued the 39-page opinion on October 20, 2026, in AFGE v. OPM, No. 1:25-cv-01237 (DLC). If you are a current federal employee, a retiree, or anyone who ever applied for a federal job, this ruling concerns records about you.
What the Court Found
The opinion's first paragraph says OPM gave DOGE agents broad access to this information "even though no credible need for this access had been demonstrated." The court found violations of the Privacy Act, 5 U.S.C. § 552a(b) and (e)(10). The Privacy Act requires a need for the record in order to do the job, and the court found that need was never shown. A separate claim against the DOGE defendants, brought as an ultra vires claim, was dismissed.
How the Access Was Granted
From Inauguration Day 2025, OPM opened at least fourteen systems to twenty DOGE-related people, almost all with administrative access. OPM's own career database administrators were locked out. The judge described some of the DOGE agents as "unusually young and inexperienced," and few of them ever logged in. OPM's chief information officer testified that access can be granted within minutes, yet it was granted in advance anyway.
The opinion also noted that the one DOGE agent still at OPM completed cybersecurity training in April 2026, almost fourteen months after the lawsuit was filed, and that OPM removed DOGE permissions shortly before filing reports in the litigation. The court wrote that the defendants "barely defend its legality."
A Problem of People, Not Procedures
One finding stands out. The court concluded that this was not a failure of procedures. The violations resulted, in the court's words, from "the failure of particular individuals to abide by the Privacy Act." The rules were in place, and individuals did not follow them.
What Happens Next
This ruling is not the final word. The remedy will be decided by a separate order. The plaintiffs, who are AFGE, the Association of Administrative Law Judges, and individual federal employees represented by the Electronic Frontier Foundation with co-counsel, are seeking an accounting of every disclosure and deletion of any copies. OPM has said its own review found nothing was copied out. The judge has not ruled on that question.
Whether OPM must tell individual employees who accessed their files is still undecided. To follow the remedy order and other developments affecting federal employees, sign up for our free newsletter.
Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation. You can contact Southworth PC at attorneysforfederalemployees.com.