The Office of Personnel Management unlawfully granted the Department of Government Efficiency access to sensitive federal personnel data last year, a federal judge found.
Judge Denise Cote ruled Tuesday that OPM violated federal privacy law and bypassed established cybersecurity practices when it shared records on millions of past, current and aspiring federal employees with DOGE agents in early 2025.
A preliminary injunction order from Cote last year has been blocking DOGE agents’ data access since June 2025, after the judge found plaintiffs were likely to succeed in their allegations in the case. The decision this week finds plaintiffs’ arguments ultimately successful.
“At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary,” Cote, a judge in the U.S. District Court for the Southern District of New York, wrote in Tuesday’s decision.
Democracy Defenders Fund, one of the organizations representing plaintiffs in the case, called this week’s ruling a “resounding victory.”
“The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE,” said former U.S. Ambassador Norm Eisen, currently executive chair of Democracy Defenders Fund. “The Privacy Act exists for a reason, and today the court made clear that no agency or special government employee like Musk is above the law.”
In February 2025, the American Federation of Government Employees led a group of plaintiffs in suing OPM for permitting DOGE to access records on federal employees — including personally identifiable information (PII) — in the early part of the Trump administration.
Plaintiffs argued that OPM violated federal law by granting “unvetted and untrained” DOGE agents broad access to multiple systems that house personal data on millions of individuals, including current and former federal employees.
Lawyers for the Trump administration argued that DOGE agents had “modernization responsibilities” and were acting at the direction of the executive order that created DOGE. But Cote ruled that IT modernization should not require access to confidential PII on federal employees.
Following Cote’s June 2025 preliminary injunction, OPM told the court that it began rescinding permissions from DOGE agents. None have had access to sensitive personnel data since September 2025. Only one former DOGE agent remains at OPM and he cannot currently access PII on federal employees, according to the government’s court filings.
Although DOGE has been disbanded, Cote found that its termination only narrows, but doesn’t fully eliminate, the possibility for unlawful data access to occur again.
“This conclusion does not diminish OPM’s admirable efforts during this litigation to strengthen its protocols,” Cote said. “But the misconduct at issue … resulted from the failure of particular individuals to abide by the Privacy Act and to honor the safeguards already in place at OPM.”
In a previous opinion in the case, Cote also found, “it is ultimately no more difficult for OPM to ignore these new protocols than to ignore its old procedures.”
While Tuesday’s order resolves the case’s central legal arguments, Cote said the scope of relief will be considered in a separate ruling. Plaintiffs are still seeking to delete or expunge any copies of OPM data that DOGE agents still possess.
“We have long known OPM broke the law when it recklessly disclosed personal records to DOGE agents. The court has now confirmed that,” said F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which represents plaintiffs in the case. “OPM and DOGE now owe it to the unions and federal workers who brought this case to clean up the cybersecurity mess they created.”
An OPM spokesperson declined to comment, saying the agency does not comment on ongoing litigation. Federal News Network’s emails seeking comment from the White House and the Department of Justice were not returned.
In recent months, more details have emerged on DOGE’s actions during the early days of the Trump administration. The Government Accountability Office reported in August that many of DOGE’s claims of cost savings don’t have supporting evidence and some are simply incorrect. But GAO also found that while many DOGE agents have vacated their posts, information on who they were, and what they did, remains murky.
If you would like to contact this reporter about recent changes in the federal government, please email drew.friedman@federalnewsnetwork.com or reach out on Signal at drewfriedman.11
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.