OPM illegally shared millions of employee records with DOGE, federal judge rules

A U.S. district judge in New York found that the Office of Personnel Management violated federal privacy law and flouted cybersecurity practices when it shared federal employee records with members of the Trump administration’s Department of Government Efficiency.

In a Tuesday ruling, Judge Denise Cote of the U.S. District Court for the Southern District of New York said that OPM granted DOGE agents access to systems holding records for tens of millions of past, current and aspiring federal workers without a credible reason.

Cote said the government provided no explanation for why DOGE’s purported modernization efforts needed access to personally identifiable information (PII) when that access wasn’t needed in past modernization efforts.

“The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII,” Cote said.

The decision is a win for federal workers and their advocates in a long-running challenge to DOGE’s controversial activities premised on an aspiration of efficiency. In a statement Tuesday, F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which represents the workers and their unions, cheered the decision, calling it a “victory for data privacy.”

Trujillo also noted that there is still more to come in the case on OPM’s cybersecurity obligations.  

“Since the case was filed, many DOGE agents have left the government and OPM has rescinded their database access. However, OPM should still clean up the cybersecurity mess it created. The court will decide the remedy at a later date,” Trujillo said.

While Cote’s ruling concluded that the government had violated statute, she has yet to make a decision on remedies. The workers have, among other things, asked the court to mandate the deletion of any extracted data. 

Case background

The case was filed in February 2025 by federal workers and their unions — including the American Federation of Government Employees — arguing DOGE’s access to several systems at the government’s human capital agency violated the Privacy Act, federal administrative law, and went beyond federal statute. 

Cote previously issued a preliminary injunction in favor of the workers in June 2025 based on the government’s likely violation of the Privacy Act. In her decision Tuesday, Cote ultimately found that the workers succeeded on their claims under the Administrative Procedure Act, which are predicated on the government’s violations of the Privacy Act.

The litigation has provided a window into DOGE members and OPM’s privacy practices. 

Following the preliminary injunction, Cote required the government to provide information about procedures OPM had put in place to safeguard information containing PII in accordance with the Privacy Act, as well as the permissions granted to DOGE agents. 

The government has fought to dismiss the workers’ challenges. That included arguments that  none of the remaining DOGE agents had access to personal information in question, that DOGE had expired, and that OPM had implemented new procedures. 

But Cote hasn’t been persuaded. In her Tuesday order, she again concluded that the government hadn’t established that the same conduct wouldn’t happen again. Cote also found that the termination of the DOGE temporary organization in July did not amount to an end to the work outlined in the executive order that created the organization.

The same executive order that created DOGE as a temporary organization renamed the U.S. Digital Service to the U.S. DOGE Service and stated that the termination of the temporary group doesn’t “imply the termination, attenuation, or amendment of any other authority or provision of this order.” 

“The termination thus narrows, but does not eliminate, the circumstances in which the challenged conduct could recur,” Cote said.

Additionally, on the mootness argument, Cote said that the timing of the agency’s compliance actions suggested it was matching deadlines in the litigation rather than showing a meaningful change in behavior. 

Audits and challenges

Cote’s decision comes as challenges to and investigations of DOGE’s conduct continue to shed more light on the organization’s actions. Several recent reports from the Government Accountability Office found the group made errors and misrepresentations in its contract terminations tally, and didn’t leave much of a paper trail on ethics training or financial disclosures for its affiliates. 

A challenge to whether the shadowy organization’s records can remain out of the public eye is pending before the Supreme Court. Earlier this month, the justices agreed to hear arguments in a challenge seeking documents about the organization’s involvement in worker terminations in the early days of the second Trump administration.

The White House, OPM, and Department of Justice, which represents the government, didn’t respond to FedScoop’s request for comment.