Big Win for Federal Workers: Federal Court Rules OPM Broke the Law by Handing DOGE Access to Sensitive Data
October 21, 2026
U.S. District Court for the Southern District of New York rules OPM unlawfully disclosed records belonging to tens of millions of current, former, and prospective federal workers
WASHINGTON, D.C. — A federal judge in New York ruled Tuesday that the U.S. Office of Personnel Management (OPM) violated the Privacy Act when it gave Department of Government Efficiency (DOGE) employees broad access to systems containing sensitive personal data belonging to tens of millions of current, former, and prospective federal employees.
The case was brought in February 2025 on behalf of American Federation of Government Employees, Association of Administrative Law Judges, and individual current and former federal workers. The plaintiffs are represented by Democracy Defenders Fund, the Electronic Frontier Foundation, Lex Lumina LLP, and The Chandra Law Firm LLC.
In January 2025, during the early days of the Trump administration, OPM gave DOGE—then led by Elon Musk—access to federal workers’ confidential personnel files. DOGE claimed access was required for IT modernization and undetermined future needs.
Rejecting those arguments, the court noted that “the defendants barely defend its legality” and emphasized that “IT modernization does not necessarily require access to confidential” personal information. The court further ruled that DOGE employees had no job-related need to access employees’ personal information. The judge rebuked DOGE’s and OPM’s willingness to break the law, writing, “The effectiveness of any law and such government safeguards ultimately depends on the fidelity of those entrusted to observe and enforce them.”
The court issued a preliminary injunction in June 2025, which means OPM had to halt DOGE employees’ access to personal data. Tuesday’s ruling did not determine whether further relief is warranted. The court will solicit input from the parties on the appropriate next steps.
Co-counsel in the case issued the following statements:
“The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE,” said Amb. Norm Eisen (ret.), executive chair of Democracy Defenders Fund. “This is a resounding victory for ordinary people and a rebuke of the administration’s inexplicable efforts to remake and dismantle our government. The Privacy Act exists for a reason, and today the court made clear that no agency or special government employee like Musk is above the law.”
“This ruling is a victory for our privacy rights, which have never been more important or under greater threat,” said F. Mario Trujillo, Senior Staff Attorney at the Electronic Frontier Foundation. “We have long known OPM broke the law when it recklessly disclosed personal records to DOGE agents. The court has now confirmed that. OPM and DOGE now owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created.”
Rhett Millsaps, managing partner of Lex Lumina LLP, added, “This case highlights the critical importance of an impartial judiciary as a final bulwark against our lawless executive branch, feckless Congress, and the oligarchs they serve.”
# # #
Democracy Defenders Fund brings together a nonpartisan team to work with national, state and local allies across the country to defend in real-time the foundations of our democracy.
For media inquiries, contact press@democracydefenders.org.
