On 20 October 2026, Judge Denise Cote of the Southern District of New York granted summary judgment to the plaintiffs in American Federation of Government Employees v. OPM. She held that the Office of Personnel Management broke the Privacy Act of 1974 when it gave people associated with the Department of Government Efficiency broad access to federal personnel systems. The opinion opens bluntly: OPM granted the access to records on "tens of millions" of past, current and aspiring federal employees "even though no credible need for this access had been demonstrated." The remedy has not been decided.
What the court actually held
The case was filed on 11 February 2025 and raised five claims: two under the Privacy Act, two under the Administrative Procedure Act (APA), and one ultra vires claim. Judge Cote granted the plaintiffs' cross-motion on their APA claims, where the Privacy Act violations are reviewed. She granted the government's motion only on the ultra vires claim.
Two Privacy Act provisions were at issue. The first is the disclosure limit in 5 U.S.C. § 552a(b). An agency may not disclose a record without the individual's consent, subject to exceptions. The relevant exception covers agency personnel "who have a need for the record in the performance of their duties." The second is the safeguards duty in § 552a(e)(10), which requires "appropriate administrative, technical, and physical safeguards" to protect the security and confidentiality of records.
The court found OPM violated both. Disclosure went to people who were not OPM employees or had no need for the records in their OPM duties. OPM also set aside its own established cybersecurity practices for people brought in to pursue the DOGE agenda. EFF, which represents the plaintiffs, quotes the judge rejecting the claim that modernization drove the access: the record "provides no support" for that finding.
The strongest case for the government
The government's position deserves a fair statement. An elected administration is entitled to direct agency operations. Federal personnel systems are old, and modernization or fraud-detection work can require deep technical access. The Privacy Act's need-to-know exception was written to allow just that kind of internal use. A court that second-guessed every access grant would slow the legitimate IT reform that agencies need.
The opinion does not deny that. It turns on the record. In earlier rulings, Judge Cote found that OPM bypassed its own protocols and could not show a credible need. A statute that exempts internal users does not exempt anyone an agency chooses to label as internal.
Why this is a pro-innovation outcome
A publication that favours open markets and proportionate regulation might be expected to side with a government that wanted to move fast. We think the ruling supports our position, for three reasons.
First, the ruling used a fifty-year-old, technology-neutral statute. No new data-protection regime was needed. The Privacy Act's two rules, limit disclosure and secure what you hold, were enough to decide the case. That is the argument for principle-based law over prescriptive technology mandates. It also shows that the US is not a jurisdiction without data-protection law, whatever its lack of a comprehensive consumer statute suggests.
Second, security failures are an innovation cost. Personnel files hold Social Security numbers, background-investigation details and financial histories. A breach or misuse of that data erodes trust in digital government and gives agencies a reason to avoid modern systems. Following the safeguards duty is what makes modernization sustainable.
Third, the procedure is a model of proportionate judicial review. The court issued a preliminary injunction on 20 June 2025 that required the government to file reports on access permissions. It then refused, on 19 December 2025, to dismiss the case as moot, because OPM had not shown the conduct could not recur. It did not ban modernization. It required OPM to follow the statute while doing it.
The remedy question
The next phase is the most important. According to reporting on the ruling, many DOGE agents have left government and OPM has revoked their access. The court said these changes do not moot the case but raise "significant questions" about whether any relief is necessary. The December 2025 opinion records that the government argued only five DOGE agents still had access and that none could reach the plaintiffs' data.
We would urge Judge Cote to choose relief that is forward-looking and verifiable. That means a declaratory judgment, reporting duties tied to the existing GAO and OPM Inspector General audits, and a clear written standard for granting access to systems of records. Sweeping or punitive orders would invite appeals and delay the security improvements that employees actually need. A narrow order that holds up on appeal is worth more than a broad one that does not.
The litigation is not unified. A parallel case in the District of Maryland, brought by the National Treasury Employees Union, saw its injunction stayed by an appeals court pending further action by the lower court. The legal question, how far an agency can stretch the need-to-know exception for politically appointed outsiders, could still reach a higher court.
What to watch
- The remedy order: whether the court issues a declaration, a narrow injunction, or both.
- Appeals: the government may challenge the APA and Privacy Act reasoning.
- Audit findings: the GAO and OPM Inspector General reviews could show what data was actually exposed.
- Policy follow-through: whether OPM's updated cybersecurity and privacy policy gives a durable access standard.
The main lesson is simple. Governments, like companies, can move quickly with data only if they keep the rules that protect it. The court has said that OPM did not.