A federal judge has ruled that the Office of Personnel Management (OPM), the federal government's human resources agency, violated the Privacy Act and bypassed its own cybersecurity practices when it gave people associated with the Department of Government Efficiency (DOGE) broad access to records on federal workers in early 2025, Federal News Network reported Thursday. The decision settles the legal merits rather than a preliminary question, and it puts on the court record a finding that a central agency handed out sweeping access to sensitive personnel data without showing anyone needed it, the kind of access-control failure every large organization is expected to prevent.
What Happened
U.S. District Judge Denise Cote of the Southern District of New York issued the 39-page opinion and order Oct. 20. The suit was filed Feb. 11, 2025, by current and former federal employees and their unions, led by the American Federation of Government Employees.
The opinion opens by finding that OPM gave the DOGE group broad access to systems of records containing personal information on tens of millions of past, current and prospective federal employees, "even though no credible need for this access had been demonstrated." Cote held that the grants violated two parts of the Privacy Act of 1974: one restricting disclosure of records, and one requiring agencies to set appropriate safeguards for the security and confidentiality of records. That made them unlawful under the Administrative Procedure Act, the statute that lets courts set aside agency actions that break the law.
The court found no contemporaneous explanation in the record connecting any DOGE agent's duties to the access granted. Instead, OPM's then-chief information officer testified that access was granted in case it might be needed. Cote rejected the government's argument that DOGE's mandate to modernize information technology justified the access, noting testimony from a former OPM chief information officer who had worked on modernization at two agencies without touching the personal data in those systems.
The government, she wrote, "barely defend[s]" the legality of the access, relying instead on later events to argue that the case is moot. Cote granted the plaintiffs' motion for summary judgment on their Administrative Procedure Act claims, but sided with the government on a separate claim that the DOGE defendants, a group that includes Elon Musk, acted beyond their legal authority. She said the Administrative Procedure Act already gave the plaintiffs a route to relief.
OPM declined to comment, citing the ongoing litigation, and the White House and Justice Department did not respond, Federal News Network reported. The government says no DOGE agents have had access to OPM systems containing personal data since September 2025.
Why It Matters
The ruling is about governance, not hacking. The court treated access granted in anticipation of future use as falling short of the Privacy Act's need-to-know standard, and it found that OPM ignored safeguards it applies to everyone else. Many DOGE agents acknowledged completing required cybersecurity and privacy training only weeks after receiving access, and OPM granted administrative access in violation of the principle of least privilege, which limits each user to the access a job requires.
For boards and executives, two findings carry beyond government. An earlier ruling in the case found that DOGE agents also obtained data indirectly, through career OPM staff who extracted it for them, a path that controls on system logins alone would miss. And OPM's annual security audit under the Federal Information Security Modernization Act, dated Nov. 24, 2025, did not mention the broad DOGE access grants at all, the judge noted.
Context
Cote issued a preliminary injunction blocking the access in June 2025 and in December 2025 refused to dismiss the case as moot, citing OPM's history of bypassing its security protocols and the government's failure to explain what happened to extracted data. Because all of the permissions have since been rescinded, she said this week that they need not be formally set aside.
What to Watch
The court will ask the parties what permanent relief, if any, is appropriate and decide it separately. The plaintiffs have asked for an order requiring DOGE, its agents and any third party to delete or expunge OPM records extracted and moved elsewhere, an accounting of the disclosures and a plan to mitigate their effects. Audits by the Government Accountability Office and OPM's inspector general that touch on DOGE access were still pending as of the government's March 2026 filing. The government has preserved earlier arguments for a possible appeal.
