Court Finds OPM Violated Privacy Act in DOGE Access to Employee Data

A federal judge has found that the U.S. Office of Personnel Management (OPM) violated the Privacy Act when it gave Department of Government Efficiency (DOGE) personnel broad access to systems holding personally identifiable information (PII) about millions of current, former, and prospective federal employees. The access occurred in early 2025 and involved OPM systems containing sensitive workforce records. In a ruling described in coverage as a decision by Judge Denise Cote of the U.S. District Court for the Southern District of New York, the court concluded that the government had not established a credible need for DOGE agents to receive this level of access for modernization work.

The dispute began in February 2025, when federal workers and unions, including the American Federation of Government Employees, challenged DOGE’s access to systems at the federal government’s human-capital agency. Their claims alleged violations of the Privacy Act and federal administrative law, as well as action beyond statutory authority. In June 2025, Judge Cote issued a preliminary injunction blocking the access based on the government’s likely Privacy Act violation. The later ruling found for the workers on claims under the Administrative Procedure Act that were predicated on the Privacy Act violations.

For federal contractors, the decision is a relevant risk signal even though it does not announce a solicitation, contract award, financial penalty, or compliance deadline. Companies that operate, modernize, host, or provide support for federal personnel and workforce systems may be asked to demonstrate that access to PII is authorized, narrowly scoped, logged, and limited to a documented mission need. The ruling puts a particular focus on whether modernization efforts actually require exposure to identifiable records, rather than whether a project is broadly characterized as modernization.

The court has not yet determined remedies. Among the requested remedies is deletion of data that may have been extracted, while defendants argued that changed circumstances made the case moot. Reporting says many DOGE agents have left government service and OPM rescinded their database access after litigation began; those developments have not resolved the outstanding question of what happened to information already accessed or copied. Judge Cote’s finding underscores that ending an account or revoking permissions may not by itself address data handling, retention, or deletion obligations.

The court’s reasoning also bears on how contractors document and govern access in environments containing federal employee information. Judge Cote wrote: “The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII.” For vendors, that observation highlights the importance of tying permissions to specific duties and substantiated requirements, maintaining evidence of approval and oversight, and establishing procedures for data minimization and disposition. The ruling does not establish new contract terms, but it may inform agency scrutiny of existing privacy and cybersecurity practices.

• OPM granted DOGE personnel broad access to systems containing PII for millions of current, former, and prospective federal employees in early 2025.
• Judge Denise Cote found that the access violated the Privacy Act; the case also proceeded under the Administrative Procedure Act.
• A June 2025 preliminary injunction blocked the access after the court found a likely Privacy Act violation.
• The case was filed in February 2025 by federal workers and unions, including the American Federation of Government Employees.
• The court said the record did not support the claim that a modernization agenda prompted the sweeping, expedited access to systems of records containing PII.
• Remedies remain undecided, including whether data extracted from OPM systems must be deleted; defendants argued that changed circumstances made the case moot.
• Reporting says many DOGE agents have since left government and OPM rescinded their database access, but those steps do not settle data-retention questions.
• Contractors supporting federal workforce, modernization, or personnel systems should review authorization, least-privilege access, auditability, data minimization, and retention or deletion controls.
• The ruling identifies no procurement award, financial penalty, new contract opportunity, or specific compliance deadline.