Federal Judge Rules OPM Broke the Privacy Act by Giving DOGE Access to Federal Workers' Data

A federal judge has found that the Trump administration's Office of Personnel Management handed DOGE access to the personal records of tens of millions of people in violation of federal law.

Judge Denise Cote of the U.S. District Court for the Southern District of New York issued the 39-page ruling on Tuesday, Oct. 20. She held that OPM violated the Privacy Act of 1974 and bypassed its own cybersecurity practices when it gave DOGE personnel access to systems holding records on current, former and prospective federal employees.

What the court found

Cote said the government never gave a credible reason why DOGE needed personally identifiable information. Justice Department lawyers had argued the access served an effort to modernize government systems. The judge noted that IT modernization does not necessarily require confidential personal records, and that previous modernization efforts did not demand this kind of access.

Lawyers also said agents were given access in case they needed the data later. According to the ruling, the government never tied that access to any agent's actual duties.

The ruling includes a passage that has drawn wide attention: "The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary."

The records at issue include employee files, background check results, medical files and banking information, according to the government's own court filings describing what DOGE agents reached.

The timeline

Court documents show 20 DOGE employees received access to OPM systems between Jan. 20, 2025, and March 6, 2025. Some worked for OPM. Others were paid by different agencies. Certain DOGE personnel kept access through September 2025.

The plaintiffs sued in February 2025. They are the American Federation of Government Employees, the Association of Administrative Law Judges, and individual current and former federal workers. Cote issued a preliminary injunction in June 2025 that halted DOGE agents' access to the personal data. Tuesday's decision found the plaintiffs' arguments ultimately successful, not just likely to succeed.

The government's position

The administration's main fallback was that the case no longer matters. The government told the court that only one of the agents remains at OPM and that he has no access to systems containing personal employee data. DOGE itself shut down in July 2026. OPM has also revised its disclosure policies so that only OPM employees and contractors, not detailees, can reach those systems.

Cote rejected the mootness argument. She called the policy updates admirable but said they seemed to track deadlines in the litigation. She also said the case concerned misconduct stemming from "the failure of particular individuals," not deficient procedures.

Musk gave his own rationale at the time. "These databases don't talk to each other," he said in a Fox News interview in February 2025. "And that's really the source of, that's the biggest vulnerability for fraud, is the fact that these databases don't talk to each other. So we need to reconcile the databases."

OPM and the Justice Department did not respond to requests for comment on the ruling.

Plaintiffs claim victory

The plaintiffs' lawyers framed the decision as a vindication. "The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE," said Norm Eisen, executive chair of Democracy Defenders Fund, which represented the plaintiffs. He called it a rebuke of the administration's efforts to remake and dismantle the government.

F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which is also co-counsel, said the court confirmed what the plaintiffs had long said: OPM broke the law when it disclosed personal records to DOGE agents.

The Privacy Act is a post-Watergate law. It exists to keep the federal government from treating citizens' records as an open file cabinet. That principle does not change depending on who is in the White House or how popular the stated goal is.

DOGE says it saved $215 billion through canceled contracts and cut roughly 300,000 government positions. Those are the group's own figures. Former acting IRS Commissioner Douglas O'Donnell has warned that the cuts will have lasting effects on the government's ability to improve efficiency through updated technology. Whatever the savings, the court has now found that the data access at issue was unlawful, and that the government could not explain why it was needed.

What comes next

Cote did not impose a final remedy. She said it is unclear whether any relief is necessary now, given the changes at DOGE and OPM, and that she will ask both sides to submit views on what relief, if any, is appropriate. In the meantime she encouraged the parties to confer and see whether they can reach an agreement.

The plaintiffs say OPM and DOGE owe the workers who brought the case more than a finding of illegality. Whether the court orders anything beyond the injunction already in place, such as deletion of copied data or additional safeguards, will depend on those filings.