OPM Unlawfully Gave DOGE Access to Federal Employee Data, Judge Rules
Judge Denise Cote finds the Office of Personnel Management broke federal privacy law when it shared records on millions of workers with DOGE agents in early 2025
By AXY Government Desk ·
Key points
- Judge Denise Cote ruled Tuesday that OPM unlawfully gave DOGE agents access to sensitive federal personnel data in early 2025, violating federal privacy law and cybersecurity practices.
- A June 2025 preliminary injunction had already blocked DOGE access, and OPM said none of its agents have had access to sensitive personnel data since September 2025.
- Plaintiffs are still asking the court to delete or expunge any copies of OPM data that DOGE agents still possess.
A federal judge has ruled that the Office of Personnel Management, the agency that handles human resources for the federal government, unlawfully gave the Department of Government Efficiency access to sensitive personnel data last year. Judge Denise Cote of the U.S. District Court for the Southern District of New York said Tuesday that OPM violated federal privacy law and skipped established cybersecurity practices when it shared records on millions of past, current and aspiring federal employees with DOGE agents in early 2025.
The ruling turns a temporary block into a finding on the merits. Cote had already issued a preliminary injunction in June 2025, which stopped DOGE agents from reaching the records while the case moved forward. In her Tuesday decision, she found the plaintiffs' arguments ultimately successful, meaning the court has now said the access itself was unlawful, not just that it might be.
DOGE, short for Department of Government Efficiency, was created by executive order early in the Trump administration. Its staff moved into federal agencies quickly that year, and some of them wanted access to the government's computer systems. That access is where this case begins. The records at issue are the kind agencies hold on anyone who has worked for, applied to, or been hired by the federal government, and they include some of the most personal details a government keeps on its own people.
Who Sued and What They Argued
In February 2025, the American Federation of Government Employees led a group of plaintiffs in suing OPM. They said the agency let DOGE into records on federal employees, including personally identifiable information, or PII. PII is any data that can be used to identify a specific person, such as names, addresses and identification numbers.
The plaintiffs argued that OPM violated federal law by granting "unvetted and untrained" DOGE agents broad access to multiple systems holding personal data on millions of people. That includes current and former federal employees. The concern was not only who saw the data but also whether anyone had checked those agents before giving them the keys.
Democracy Defenders Fund is one of the organizations representing the plaintiffs, and it called this week's ruling a "resounding victory." Norm Eisen, a former U.S. ambassador who is currently executive chair of the group, said, "The federal government had no business handing the personal data of tens of millions of people to Elon Musk and DOGE," and added, "The Privacy Act exists for a reason, and today the court made clear that no agency or special government employee like Musk is above the law."
The Privacy Act is the 1974 federal law that limits how agencies collect, keep and share personal records about individuals. Eisen's comments point to the core of the case: the question is not whether DOGE wanted information, but whether the government had the legal right to hand it over.
Why Judge Cote Said the Government's Defense Fell Short
Lawyers for the Trump administration argued that DOGE agents had "modernization responsibilities" and were acting at the direction of the executive order that created DOGE. In other words, they said updating the government's technology was part of the agents' job, and that the job required access to these systems.
Cote did not accept that argument in full. She ruled that IT modernization should not require access to confidential PII on federal employees. Modernizing a computer system can mean redesigning software, moving data or fixing security gaps, but none of those tasks automatically requires reading the personal files of the workforce. That gap between the stated mission and the access granted is central to the ruling.
Cote also criticized how the government defended the case. Writing in Tuesday's decision, she said, "At this point, there is no meaningful dispute concerning the underlying conduct. The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary."
In plain terms, the government was not arguing that the access was lawful. It was arguing that changes made after the injunction meant the court no longer needed to decide the matter or order anything for the future. A case is moot when the dispute has ended, and prospective relief means a court order about what will happen going forward. Cote's comments suggest she was not persuaded that the end of access settled the question.
What Changed After the June Injunction
After Cote's June 2025 preliminary injunction, OPM told the court that it began rescinding permissions from DOGE agents. According to the government's court filings, none of those agents have had access to sensitive personnel data since September 2025.
The filings also say only one former DOGE agent remains at OPM, and he cannot currently access PII on federal employees. For an ordinary worker, that is the most concrete part of the government's position: the people with the most direct access have been cut off, and the remaining person is not able to see those records now.
This is the government's strongest argument and also the reason the case has not simply ended. If access stopped months ago, the question becomes what the court should order to prevent a return to that arrangement. Cote's ruling answers part of that by stating that the earlier access was unlawful.
The Remaining Fight Over Copies of the Data
Even with access shut off, the plaintiffs are still asking for something more. They are seeking to delete or expunge any copies of sensitive OPM data that DOGE agents still possess. To expunge data means to remove it permanently, not just block future viewing.
That request matters because access to a live system and possession of a copy are different problems. A ban on logging in does not automatically reach files that were downloaded or moved elsewhere. Whether those copies still exist, where they are, and who can verify their removal are questions the court record, as described in the source, does not settle.
The next test is whether the court orders deletion of any remaining copies and sets out how OPM or the government would confirm it. Without that step, a ruling against the government could still leave personal data of millions of people outside the systems that were meant to protect it.
What the Ruling Means for Federal Workers
For the people whose records were in these systems, the ruling is less about legal arguments and more about trust. Federal employees, former employees and job applicants give the government details about their identity, pay and background because they have to. The Privacy Act is supposed to limit how that information moves between agencies and individuals.
Cote's decision does not by itself change what is in those files, and it does not describe any specific harm to a specific person in this record. What it does is put a federal court on record saying that the way DOGE gained access to the data broke the rules that protect it.
The case now turns on what happens next in the court: whether the judge orders the removal of remaining copies, whether the government contests any further relief, and whether the ruling leads to tighter controls on how outside staff reach personnel systems. Those are the decisions that will determine whether this ruling protects the data going forward or only records what happened in 2025.
Questions and answers
What did the judge rule about OPM and DOGE?
Judge Denise Cote of the U.S. District Court for the Southern District of New York ruled that OPM unlawfully granted DOGE agents access to sensitive federal personnel data in early 2025. She found the agency violated federal privacy law and bypassed established cybersecurity practices.
Why did the court block DOGE from federal employee data?
Cote issued a preliminary injunction in June 2025 after finding the plaintiffs were likely to succeed in their allegations. The injunction stopped DOGE agents from accessing the records while the case continued, and her later ruling found the plaintiffs' arguments ultimately successful.
Do DOGE agents still have access to federal employee records?
According to the government's court filings, OPM began rescinding DOGE permissions after the June 2025 injunction, and none have had access to sensitive personnel data since September 2025. Only one former DOGE agent remains at OPM, and he cannot currently access personally identifiable information on federal employees.
Topics: Office of Personnel Management, DOGE, Judge Denise Cote, Privacy Act, Elon Musk, federal employee data, American Federation of Government Employees
Sources: Federal News Network