What's Happening?
A federal court in New York ruled on October 20, 2026, that the U.S. Office of Personnel Management (OPM) violated the Privacy Act of 1974. The violation occurred when OPM provided personnel affiliated with the Department of Government Efficiency (DOGE)
with extensive access to databases containing personal information of tens of millions of current and former federal employees and job applicants. Judge Denise Cote granted summary judgment to the plaintiffs, finding that OPM breached the Privacy Act's restrictions on disclosure and its duty to safeguard personal records. OPM began granting this access in January 2025, following an executive order that directed federal agencies to provide DOGE Service access to agency records for a technology modernization initiative. The American Federation of Government Employees, the Association of Administrative Law Judges, and individual federal workers subsequently filed a lawsuit, arguing that OPM bypassed its own cybersecurity procedures and failed to establish a legitimate need for DOGE personnel to access these records. Although OPM later withdrew access and tightened cybersecurity rules, the court determined these changes did not sufficiently address the risk of recurrence to render the case moot.
Why It's Important?
This ruling underscores the critical importance of data privacy and security within federal agencies, particularly concerning sensitive personal information of government employees and applicants. The court's decision reinforces the 'need-to-know' principle embedded in the Privacy Act, emphasizing that the scope of a technology program does not automatically justify broad data access. For federal workers and job applicants, the ruling affirms their privacy interest in controlling who can access their employment-related information, even when it remains within government systems. The case highlights potential vulnerabilities that can arise during government technology modernization efforts, where new initiatives might inadvertently lead to unauthorized or overly broad access to existing sensitive databases. The dispute over an accounting of disclosures further emphasizes the practical dimension of this privacy interest, distinguishing between logs that track data exfiltration and records that detail who received access and for what purpose. This legal precedent could influence how future inter-agency data-sharing initiatives are structured and implemented, demanding more stringent adherence to privacy regulations.
What's Next?
Following the ruling, the plaintiffs are seeking an accounting of the disclosures made and an order requiring the deletion of any copies of personal information held outside OPM's systems. Judge Cote has reserved for a separate order whether to grant a permanent injunction or other relief, indicating that further legal actions and decisions are pending regarding the remedies for the Privacy Act violation. F. Mario Trujillo, a senior staff attorney at the Electronic Frontier Foundation, which represented the plaintiffs, has called on OPM and DOGE to address the cybersecurity consequences stemming from the unauthorized access. This suggests that both agencies may face pressure to implement more robust data governance and cybersecurity protocols. The outcome of the requested accounting and potential injunction could set a precedent for how federal agencies manage data access during modernization efforts and how they are held accountable for privacy breaches. It may also lead to increased scrutiny of executive orders that mandate data sharing across government entities, ensuring they align with existing privacy laws.
Beyond the Headlines
This case delves into the complex interplay between government efficiency initiatives and individual privacy rights. While technology modernization aims to streamline operations, it often introduces new challenges in safeguarding sensitive data. The ruling highlights a potential systemic issue where the drive for interoperability and data sharing across government departments might inadvertently compromise established privacy protections. Ethically, the case raises questions about the balance between administrative convenience and the fundamental right to privacy for federal employees. Legally, it reinforces the enduring relevance of the Privacy Act of 1974 in the digital age, demonstrating that its principles apply even when data remains within government networks. Culturally, it could foster greater awareness among federal employees about their data rights and encourage more proactive oversight of how their personal information is handled by government agencies. This development may also prompt a broader re-evaluation of data access policies across the federal government, leading to more stringent controls and transparency measures to prevent similar violations in the future.
