Judge Rules OPM Unlawfully Gave DOGE Agents Broad Access to Personnel Records

A federal judge in New York ruled Tuesday that the U.S. Office of Personnel Management unlawfully gave DOGE agents broad access to systems holding sensitive personal data on tens of millions of federal workers, retirees and job applicants, delivering a sharp judicial rebuke of how the government’s central HR agency handled high-stakes data sharing.

In an Opinion and Order dated Oct. 20, Judge Denise Cote of the U.S. District Court for the Southern District of New York granted summary judgment to the plaintiffs in American Federation of Government Employees, AFL-CIO, et al. v. U.S. Office of Personnel Management, No. 1:25-cv-01237. Cote said OPM’s decision to grant DOGE agents access to its records systems violated two provisions of the Privacy Act of 1974: the law’s restriction on disclosing records, 5 U.S.C. Section 552a(b), and its requirement that agencies protect the security and confidentiality of records, 5 U.S.C. Section 552a(e)(10). Because those provisions were violated, she held, OPM’s actions were “not in accordance with law” under the Administrative Procedure Act, the statute courts use to review federal agency action.

The ruling centers on some of the federal government’s most sensitive personnel databases. OPM maintains records on tens of millions of current, former and prospective federal employees, including names, Social Security numbers, home addresses, employment histories, benefits information and health or insurance data. That made the dispute especially significant from both privacy and cybersecurity standpoints.

“By virtue of the Court’s summary judgment ruling, OPM’s decision to grant DOGE Agents broad access to its systems of recordings containing PII has been held unlawful,” Cote wrote, referring to personally identifiable information.

The immediate practical stakes are narrower than the legal holding. According to the opinion, all of the access permissions challenged in the case have already been rescinded since the litigation began. Cote did not decide Tuesday what final remedy to impose, saying the court will seek the parties’ views before determining whether permanent injunctive relief or other measures are appropriate.

The opinion also recounts OPM’s later internal review of the access. That review, as described by the court, said it did not find evidence that DOGE agents used their permissions to export, copy, transfer or transmit the plaintiffs’ personal data outside OPM systems. Cote did not frame that as an independent finding that no data left the systems.

The lawsuit was filed Feb. 11, 2025, by current and former federal employees and two unions, the American Federation of Government Employees and the Association of Administrative Law Judges. The defendants include OPM and DOGE-related defendants named in the case, including Elon Musk. The case already produced a preliminary injunction in June 2025; Tuesday’s ruling resolved cross-motions for summary judgment.

The dispute grew out of a Jan. 20, 2025, executive order that created or renamed the U.S. DOGE Service and directed agency heads to provide DOGE “full and prompt access” to unclassified agency records and information technology systems to support a government modernization agenda. But Cote said the record in this case did not support OPM’s reliance on modernization as the reason for the access it granted.

“The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII,” she wrote.

The ruling is one of several cases to test DOGE-era access to government data, but Cote’s opinion focused squarely on OPM’s handling of personnel records and on the Privacy Act’s core limits on disclosure and its requirement that agencies safeguard the information they keep.