OPM quietly swapped out privacy assessment for governmentwide email system central to ongoing litigation
The Office of Personnel Management last Friday quietly replaced the privacy impact assessment for the governmentwide email system it has been using to send mass email blasts to the entirety of the federal government.
Why’s that important? OPM in the new privacy assessment eliminated key language that was the basis for a motion for sanctions filed by plaintiffs that same day in federal court. The plaintiffs, a group of pseudonymous federal employees, are suing the federal HR agency for not properly ensuring privacy protections for federal employees whose information was obtained and stored on that email system.
Those federal employees on Friday issued their new motion in the U.S. District Court of D.C., accusing OPM and the Trump administration of requiring federal employees to respond to recent emails asking them to list five bullet points of what they did the previous week. Despite the mandatory nature of those emails, the privacy impact assessment for the email system claims that all employee responses and interactions with the system are “voluntary.”
At least that’s what it said on the original Feb. 5 PIA, which disappeared Friday and was replaced with a new assessment that now omits any mention of responses being voluntary.
The original PIA reads: “The Employee Response Data is explicitly voluntary. The individual federal
government employees can opt out simply by not responding to the email.”
Now, in that same section about how the agency gives notice to anyone whose information is ingested and stored on OPM systems via responding to the mass emails, the new assessment, which was issued without any notice, states: “Individual federal government employees can decline to provide information by not responding to the email. The consequences for failure to provide the requested information will vary depending on the particular email at issue.”
The plaintiffs’ stance in their motion for sanctions was that despite OPM explicitly stating that responses to the email were voluntary, the agency’s “What did you do last week?” email to all federal employees was interpreted as mandatory after senior members of the Trump administration, including several agency leaders and the president’s senior adviser Elon Musk, said it was.
Preceding the delivery of the emails by a few hours on Feb. 22, Musk in a post on his X social media account said that “failure to respond [to the email] will be taken as a resignation.”
This isn’t the first time OPM has amended the record regarding the privacy impact assessment for the email system during the ongoing lawsuit. When the plaintiffs first filed their complaint, the system at hand didn’t have a PIA, which was their chief objection to begin with. But then, just before the defense entered its response to that complaint, OPM provided the missing assessment after the fact, claiming that it didn’t need to issue one but did so anyway.
In their response to the latest motion for sanctions from the plaintiffs, federal attorneys use the defense that they “never vouched for the substantive ‘accuracy’ of the Privacy Impact Statement,” adding again that the “Defendant argued that it was not required to prepare a PIA” but “that it did so anyway.”
