OPM Broke the Privacy Act With DOGE Access. Will Federal Employees Get Paid?
A federal judge has ruled that OPM violated the Privacy Act when it gave DOGE agents access to the personnel records of millions of current, former, and prospective federal employees. The question federal employees keep asking is simple: will we get paid? Under the Privacy Act as it stands, probably not, and the reasons say a lot about how much protection the law actually gives you.
What the Court Decided
On October 20, 2026, in AFGE v. OPM, No. 1:25-cv-01237 (S.D.N.Y.), the court held that OPM violated the Privacy Act by giving DOGE agents broad access to employee records. The unions in the case did not ask for money. They asked for an order: no "just in case" access to the records, an accounting of disclosures, and deletion of any copies. The court has said it will address what relief, if any, to grant in a separate order, and that decision is still pending.
Two Kinds of Relief: A Fix or a Payment
A court in a case like this can do two different things. It can order the agency to fix the problem, or it can order the agency to pay people who were harmed. The first is what the unions requested, and it is what the court is weighing now. The second is much harder to get.
Why Money Damages Are Hard to Win Under the Privacy Act
The Privacy Act allows an individual to sue when an agency's failure to comply with the Act has an adverse effect on them, 5 U.S.C. § 552a(g)(1)(D). But money damages are available only when the agency acted intentionally or willfully, 5 U.S.C. § 552a(g)(4). Even then, a person must prove actual damages. The statute sets a $1,000 minimum, but the Supreme Court has held that the minimum applies only to people who first show some actual damages. Doe v. Chao, 540 U.S. 614 (2004).
The Supreme Court has also held that "actual damages" under the Privacy Act means proven economic loss, not mental or emotional distress. FAA v. Cooper, 566 U.S. 284 (2012). Stress and worry, however real, do not count.
There is also a time limit. A Privacy Act suit generally must be filed within two years of when the person knew or should have known of the violation. 5 U.S.C. § 552a(g)(5).
Why This Case Is Different From a Data Breach
In the DOGE case, the court noted that OPM's own review did not reveal evidence that records were exported outside OPM, and no one in the case has claimed a dollar lost. Without proof of financial harm, there is nothing for damages to compensate.
Compare the 2015 OPM data breach, in which outside hackers took personnel records. That litigation ended in a $63 million settlement under the same statute, with final approval in October 2022. The difference is proof of real-world harm.
What OPM Actually Faces
The Privacy Act does not impose a fine on an agency for violating it. Unless individuals can prove financial loss, the agency's exposure may be limited to the court's order and, if the court awards them, the plaintiffs' legal fees.
What Federal Employees Can Do Now
- Watch for the remedy order. The court's decision on relief will determine what OPM must do with the access it granted and any copies that exist.
- Keep records of any financial harm. If you ever experience fraud or out-of-pocket costs you believe are tied to misuse of your records, document every charge and every dollar spent addressing it.
- Mind the two-year clock. If you believe you have a Privacy Act claim, do not wait to get advice.
If you have questions about how a Privacy Act violation affects you, the federal employee lawyers at Southworth PC can help you understand your options.
Legal Disclaimer: This content is for general informational purposes only and does not constitute legal advice. Federal employment situations are fact-specific and time-sensitive. Please consult a qualified federal employment attorney about your specific situation.