On 20 October 2026, Judge Denise Cote of the Southern District of New York granted summary judgment to the plaintiffs in AFGE v. OPM, No. 25-01237. She held that the Office of Personnel Management violated two provisions of the Privacy Act when it gave DOGE agents access to federal employees' personnel records. According to the Electronic Frontier Foundation, one provision restricts disclosure of records between agencies. The other requires agencies to protect the security and confidentiality of records. The remedy is still to be decided.
The strongest case for the government's position
The steelman for OPM is not frivolous. The Privacy Act has an internal-use exception. Under 5 U.S.C. § 552a(b)(1), an agency may share records with its own officers and employees who have a need for the record in the performance of their duties. An administration can argue that modernizing federal IT, finding waste and auditing payroll are legitimate duties. It can also argue that an elected executive should be able to direct its own staff to look at the data its own agencies hold.
That argument matters because a rule that stops any new reform team from touching agency data would be unworkable. Governments have to be able to audit and upgrade their systems.
Why the argument failed
The court did not accept it. Bloomberg Government reports that there was no meaningful dispute on the core Privacy Act violation. Cote observed that the defendants "barely defend its legality," and relied instead on later events to argue that the case was moot and that forward-looking relief was unnecessary. The plaintiffs also won on their Administrative Procedure Act claims, which rest on the Privacy Act violations.
The case is a reminder of what the need-to-know exception actually requires. It is a limit tied to duties, not a blanket permission for anyone with a government badge or a political mandate. The same principle protects people when the powerful hold the data. Personnel files contain Social Security numbers, health and benefits information, financial disclosures and security-clearance material. For millions of current and former federal workers, the sensitive information is exactly what the statute was written to ring-fence.
The second violation is the more important one for practitioners. A safeguards requirement can be breached even when the purpose behind an access grant is benign. Access control, logging, vetting and training are the working parts of data protection. If they are skipped for speed, the law treats that as a failure in its own right.
A statute from 1974 held up
The Privacy Act is a 1974 statute, written long before cloud databases and machine-learning tools. This ruling shows it can still discipline a modern data-handling decision. That is relevant to the wider US debate. Advocates of sweeping new federal privacy legislation often say the US has no real privacy law. For government-held data, at least, the law exists and a court enforced it.
There is an innovation angle as well. Agencies that want to deploy modern analytics need public trust. A government that treats its employees' records as free for the taking will find it harder to recruit talent and to ask citizens for their data in future. Proportionate rules, applied consistently, make data-driven government more sustainable.
The remedy problem
The litigation timeline explains why the remedy is the hard part. Cote issued a preliminary injunction in June 2025. Bloomberg Government reports that DOGE has since been dissolved, only one DOGE agent remains at OPM, and no DOGE agent has accessed sensitive OPM data since September 2025. EFF adds that OPM has rescinded the database access of many departed agents.
Cote found the case is not moot. But she said these changes raise "significant questions" about whether any relief is necessary. The plaintiffs seek declaratory and injunctive relief. The union earlier asked the court to require destruction of copies of personal information that DOGE-linked individuals already obtained.
This is where the ruling's practical value will be decided. We think a proportionate remedy has three parts, and each is narrower than a sweeping ban:
- Verified deletion or accounting for copied data. The gravest unresolved risk is data that left OPM's controlled systems. A declaration that access has ended does not answer where copies sit.
- Documented access controls. OPM should be required to show that the safeguards failure was fixed, not simply that the people involved left. EFF notes OPM should still clean up the cybersecurity problems the disclosure created.
- No open-ended oversight. Courts should avoid permanent supervision of an agency's IT operations. A time-limited reporting obligation, with an end date, respects separation of powers.
There is a real risk that a government can escape accountability by changing facts after being sued. If voluntary reversal alone makes relief unnecessary, an agency can disclose first and unwind later. A declaratory judgment already carries weight, and the court's finding of unlawfulness will bind future conduct. A narrow, evidence-based order on data copies would add real protection without over-reaching.
What to watch
Two things will show whether the decision changes behavior. First is the content of the remedy order, especially on copies of the data. Second is whether other agencies review their own internal data-sharing practices. The need-to-know test is easy to state and easy to ignore under political pressure. A clear ruling on a clear violation gives agency counsel a reason to take it seriously before the next data-access request arrives.