OPM illegally gave DOGE access to tens of millions of federal workers' records, judge rules.

A federal judge in New York ruled on Tuesday, Oct. 20, that the Office of Personnel Management broke federal privacy law when it handed DOGE agents broad access to the government's personnel systems early in 2025.

U.S. District Judge Denise Cote of the Southern District of New York granted summary judgment to federal workers and their unions in American Federation of Government Employees, AFL-CIO v. U.S. Office of Personnel Management, No. 1:25-cv-01237. Summary judgment means the judge decided the claims on the written record, without a trial. She found OPM gave the DOGE team access to systems "containing the personal information of tens of millions of past, current, and aspiring federal employees, even though no credible need for this access had been demonstrated." In her words: "In doing so, OPM violated the law and bypassed its established cybersecurity practices." (Opinion)

Whose files were opened

OPM keeps the paperwork of a federal career, from job application to retirement. The opinion says DOGE agents got access to "at least fourteen OPM systems, most of which contain PII," meaning personally identifiable information. According to the Electronic Frontier Foundation, which represents the workers, those records include Social Security numbers, salaries, union activities, health records, health and life insurance information, and death benefit designations for employees, retirees, and people who applied for federal jobs.

The workers sued in February 2025. The plaintiffs include the American Federation of Government Employees (AFGE), the Association of Administrative Law Judges, and individual current and former federal employees. They are represented by EFF, Lex Lumina LLP, Democracy Defenders Fund, and The Chandra Law Firm. Cote issued a preliminary injunction in June 2025 finding OPM likely violated the Privacy Act.

"Modernization" didn't cover it

The government said DOGE was modernizing OPM's technology. Cote wasn't persuaded. "The record also provides no support for a finding that it was the pursuit of a modernization agenda" that drove the access, she wrote, as FedScoop first reported.

She held that OPM violated two Privacy Act provisions, one limiting disclosure of personal records and one requiring agencies to keep records secure, and that the workers win under the Administrative Procedure Act, the law that lets courts strike down unlawful agency actions.

The government also argued the case was moot, meaning there was nothing left for a court to fix, because DOGE's temporary organization expired in July and the opinion notes no DOGE agent has had access to OPM systems with PII since September 2025. Cote rejected that, finding OPM tended to pull access and rewrite policies shortly before court deadlines. "The termination thus narrows, but does not eliminate, the circumstances in which the challenged conduct could recur," she wrote.

Who won, who lost, what's next

The workers and unions won on their main privacy claims. The government won one piece: Cote granted it summary judgment on a separate "ultra vires" claim, which argued officials acted beyond any legal authority. She also declined to formally set aside the access permissions because OPM has already rescinded them.

The fight now moves to the remedy. Cote said she will ask both sides what relief, if any, is appropriate. The workers have asked, among other things, for deletion of any data DOGE extracted. "OPM should still clean up the cybersecurity mess it created," EFF senior staff attorney F. Mario Trujillo wrote. We found no briefing schedule yet, and OPM, the White House, and the Justice Department did not respond to FedScoop's request for comment, so it's not known whether they will appeal.

The ruling lands as the administration pushes against federal unions on other fronts, including the VA's move to drop its AFGE contract covering more than 300,000 workers.

What federal workers and applicants can do now

The ruling doesn't say anyone's identity was stolen. But if you've worked for or applied to the federal government, you can protect yourself for free. A credit freeze blocks new accounts in your name and doesn't affect your score; you place it separately with Equifax, Experian, and TransUnion. A fraud alert takes one call to a single bureau. Then watch for Cote's remedy decision, which will say whether OPM must delete what DOGE took.

Sources

• Opinion and Order, AFGE v. OPM, No. 1:25-cv-01237 (S.D.N.Y.) (CourtListener)
• OPM illegally shared millions of employee records with DOGE, federal judge rules (FedScoop)
• Victory! Court Rules OPM Data Disclosure to DOGE Is Unlawful (Electronic Frontier Foundation)
• Privacy Victory! Judge Grants Preliminary Injunction in OPM/DOGE Lawsuit (Electronic Frontier Foundation)
• Big Win for Federal Workers: Federal Court Rules OPM Broke the Law by Handing DOGE Access to Sensitive Data (Democracy Defenders Fund)
• OPM's DOGE Data Access Was Unlawful, Judge Says (Law360)
• Federal judge grants preliminary injunction in challenge to DOGE record access at OPM (FedScoop)
• What To Know About Credit Freezes and Fraud Alerts (Federal Trade Commission)