A federal judge ruled on Oct. 20 that the Office of Personnel Management (OPM) violated federal privacy law by giving personnel associated with the Department of Government Efficiency (DOGE) broad access to systems containing sensitive personal information on tens of millions of current, former, and prospective federal employees.
U.S. District Judge Denise Cote of the Southern District of New York ruled that OPM violated the Privacy Act of 1974 by granting DOGE personnel access to employee records without demonstrating a legitimate need and by bypassing established cybersecurity safeguards.
“OPM’s decision to grant DOGE Agents broad access to its systems of records containing PII without a demonstrated need was unlawful,” Cote wrote in the 39-page opinion.
The ruling grants summary judgment to the American Federation of Government Employees and other plaintiffs on their Administrative Procedure Act claims. However, the court has not yet determined whether permanent restrictions on OPM’s handling of sensitive employee information are necessary.
The case stems from actions OPM took beginning Jan. 20, 2025, when President Donald Trump signed an executive order establishing DOGE to advance federal technology modernization and government efficiency.
According to the court, OPM granted 20 DOGE individuals access to at least 14 agency systems between Jan. 20 and March 6, 2025. Most of those systems contained personally identifiable information (PII), and nearly all the permissions granted were at the administrative level.
The court found that OPM officials granted access largely in anticipation that DOGE personnel might need the information for future modernization projects, rather than based on a specific operational need.
“IT modernization does not necessarily require access to confidential PII,” Cote wrote, adding that the government failed to provide evidence connecting DOGE personnel’s assigned duties to the extensive system permissions they received.
The ruling also found that OPM disregarded existing cybersecurity procedures, including the principle of least privilege, which limits users’ system permissions to those necessary to perform their duties. Some DOGE personnel received administrative access before completing mandatory cybersecurity and privacy awareness training.
The court also noted that career OPM database administrators temporarily lost system access as DOGE personnel received expanded permissions.
The court previously issued a preliminary injunction in June 2025 after finding that the plaintiffs were likely to succeed on their Privacy Act claims.
According to the ruling, OPM conducted an internal investigation between May 18 and June 5, 2026, reviewing access logs, account permissions, and potential transfers of sensitive records.
The investigation found no evidence that DOGE personnel exported, copied, or transmitted the plaintiffs’ personal information outside OPM systems. OPM determined that no additional remediation was warranted.
The government argued that these findings, along with removing DOGE personnel’s access permissions, mooted the lawsuit.
Cote rejected that argument, noting that OPM continued to defend the legality of its original access decisions and that the U.S. DOGE Service remains operational despite the July 4 expiration of the temporary DOGE organization.
The judge also questioned whether the agency’s revised safeguards would prevent similar violations.
“The effectiveness of any law and such government safeguards ultimately depends on the fidelity of those entrusted to observe and enforce them, and even the most rigorous procedures cannot secure compliance by those willing to disregard them,” Cote wrote.
The court acknowledged OPM’s efforts to strengthen its cybersecurity procedures but concluded that officials failed to follow existing legal requirements, not that the policies were inadequate.
Although the court found OPM’s original access decisions unlawful, it said the permissions no longer need to be set aside because they have already been revoked.
The court will seek additional input from both parties before determining whether permanent injunctive relief is appropriate.