Judge rules OPM unlawfully gave DOGE access to sensitive federal employee data

In a ruling this week, a federal judge found the Office of Personnel Management violated privacy law by sharing records on millions of workers with the now-defunct Department of Government Efficiency.

By LineZotpaper AI staff

Published26 October 2026

Read Time4 min

Follow this storyHear when it moves

The Office of Personnel Management unlawfully granted the Department of Government Efficiency access to sensitive federal personnel data last year, a federal judge ruled Tuesday. Judge Denise Cote of the U.S. District Court for the Southern District of New York found that OPM violated federal privacy law and bypassed cybersecurity practices when it shared records on millions of past, current and aspiring federal employees with DOGE agents in early 2025.

Judge Denise Cote ruled Tuesday that the Office of Personnel Management unlawfully granted the Department of Government Efficiency access to sensitive federal personnel data last year, violating federal privacy law and bypassing established cybersecurity practices.

The decision follows a preliminary injunction from Cote in June 2025 that blocked DOGE agents' data access, after the judge found plaintiffs were likely to succeed in their allegations. This week's order finds those arguments ultimately successful.

"At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary," Cote wrote in Tuesday's decision.

The case was brought in February 2025 by the American Federation of Government Employees and other plaintiffs, who argued that OPM violated federal law by granting "unvetted and untrained" DOGE agents broad access to systems housing personal data on millions of individuals, including current and former federal employees.

Lawyers for the Trump administration argued that DOGE agents had "modernization responsibilities" and were acting at the direction of the executive order that created DOGE. But Cote ruled that IT modernization should not require access to confidential personally identifiable information on federal employees.

Following the June 2025 preliminary injunction, OPM told the court it began rescinding permissions from DOGE agents. According to government court filings, no DOGE agents have had access to sensitive personnel data since September 2025, and only one former agent remains at OPM, currently unable to access PII on federal employees.

Although DOGE has been disbanded, Cote found that its termination only narrows, but doesn't fully eliminate, the possibility for unlawful data access to occur again.

"This conclusion does not diminish OPM's admirable efforts during this litigation to strengthen its protocols," Cote said. "But the misconduct at issue … resulted from the failure of particular individuals to abide by the Privacy Act and to honor the safeguards already in place at OPM."

In a previous opinion, Cote also wrote that "it is ultimately no more difficult for OPM to ignore these new protocols than to ignore its old procedures."

While Tuesday's order resolves the case's central legal arguments, Cote said the scope of relief will be considered in a separate ruling. Plaintiffs are still seeking to delete or expunge any copies of OPM data that DOGE agents still possess.

Democracy Defenders Fund, one of the organizations representing plaintiffs, called the ruling a "resounding victory."

"The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE," said former U.S. Ambassador Norm Eisen, currently executive chair of Democracy Defenders Fund. "The Privacy Act exists for a reason, and today the court made clear that no agency or special government employee like Musk is above the law."

F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which also represents plaintiffs, said: "We have long known OPM broke the law when it recklessly disclosed personal records to DOGE agents. The court has now confirmed that. OPM and DOGE now owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created."

An OPM spokesperson declined to comment, saying the agency does not comment on ongoing litigation. Emails seeking comment from the White House and the Department of Justice were not returned.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The ruling affirms that federal privacy law applies to executive-branch data-sharing, even for a high-profile initiative like DOGE, setting a precedent for future agency actions.
Millions of federal employees' personally identifiable information was exposed without proper vetting or training, raising ongoing cybersecurity concerns about how that data may have been used or stored.
The case continues, with plaintiffs seeking deletion of any copies of OPM data still held by former DOGE agents, so the full impact on data security and individual privacy is not yet resolved.

Background

DOGE, the Department of Government Efficiency, was created by executive order in the early days of the Trump administration to pursue cost-cutting and modernization across federal agencies. In February 2025, the American Federation of Government Employees and other groups sued OPM after it granted DOGE agents access to systems containing personally identifiable information on millions of past, current and aspiring federal employees. Judge Denise Cote issued a preliminary injunction in June 2025 blocking that access. Since then, DOGE has been disbanded, and reports from the Government Accountability Office have found that many of DOGE's claimed cost savings lack supporting evidence.

Key Perspectives

Judge Denise Cote: Found that OPM violated the Privacy Act by sharing data with unvetted DOGE agents, and that IT modernization does not require access to confidential PII. Trump administration lawyers: Argued that DOGE agents had “modernization responsibilities” and were acting under the executive order that created DOGE. Democracy Defenders Fund (Norm Eisen): Called the ruling a “resounding victory,” saying the Privacy Act means no agency or special government employee is above the law. Electronic Frontier Foundation (F. Mario Trujillo): Said the court confirmed OPM broke the law, and called for OPM and DOGE to clean up the cybersecurity mess.

What to Watch

Judge Cote's separate ruling on the scope of relief, including whether plaintiffs' request to delete or expunge copies of OPM data held by former DOGE agents will be granted.
Further reports from the Government Accountability Office on DOGE's activities and the identity of its agents, which remain murky.
Whether the ruling influences other litigation or policy debates around data access by temporary or special government employees.

Sources

OPM unlawfully let DOGE access sensitive federal employee data, judge rules · Maryland Matters

Checked

12 claims in this story checked against 1 source: 11 supported.

Show each claim

SupportedThe headline says a judge ruled OPM unlawfully gave DOGE access to sensitive federal employee data.Maryland Matters: “OPM unlawfully granted the Department of Government Efficiency access to sensitive federal personnel data last year, a federal judge found.”
SupportedThe summary describes DOGE as now-defunct.Maryland Matters: “Although DOGE has been disbanded”
Partly supportedThe summary says records on millions of workers were shared.Maryland Matters: “records on millions of past, current and aspiring federal employees”
SupportedCote ruled Tuesday that OPM violated federal privacy law.Maryland Matters: “Judge Denise Cote ruled Tuesday that OPM violated federal privacy law”
SupportedCote found that OPM bypassed established cybersecurity practices when it shared the records in early 2025.Maryland Matters: “bypassed established cybersecurity practices when it shared records on millions of past, current and aspiring federal employees with DOGE agents in early 2025.”
SupportedCote’s June 2025 preliminary injunction blocked DOGE agents’ data access after she found plaintiffs likely to succeed.Maryland Matters: “A preliminary injunction order from Cote last year has been blocking DOGE agents’ data access since June 2025, after the judge found plaintiffs were likely to succeed in their allegations in the case.”
SupportedCote wrote, “At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary.”Maryland Matters: ““At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary,” Cote”
SupportedThe case was brought in February 2025 by AFGE and other plaintiffs, who said OPM gave “unvetted and untrained” DOGE agents broad access to personal-data systems.Maryland Matters: “In February 2025, the American Federation of Government Employees led a group of plaintiffs in suing OPM”
SupportedThe story says no DOGE agents had access to sensitive personnel data after September 2025 and one former DOGE agent remained at OPM without access to PII.Maryland Matters: “None have had access to sensitive personnel data since September 2025. Only one former DOGE agent remains at OPM and he cannot currently access PII on federal employees, according to the government’s court filings.”
SupportedCote said, “This conclusion does not diminish OPM's admirable efforts during this litigation to strengthen its protocols,” and that misconduct resulted from individuals failing to follow the Privacy Act and safeguards.Maryland Matters: ““This conclusion does not diminish OPM’s admirable efforts during this litigation to strengthen its protocols,” Cote said. “But the misconduct at issue … resulted from the failure of particular individuals to abide by the Privacy Act and to honor the safeguards already in place at OPM.””
SupportedNorm Eisen said, “The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE.”Maryland Matters: ““The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE,” said former U.S. Ambassador Norm Eisen”
SupportedF. Mario Trujillo said OPM and DOGE “now owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created.”Maryland Matters: ““OPM and DOGE now owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created.””