Judge Rules DOGE Unlawfully Accessed Personnel Data
A federal judge has ruled that the U.S. Office of Personnel Management (OPM) violated federal privacy law by allowing personnel associated with the Department of Government Efficiency (DOGE) to access sensitive government personnel information. The decision, issued on October 20, 2026, represents a significant legal development in the ongoing debate over the Trump administration’s efforts to restructure the federal government and expand access to government records. The ruling establishes that the access at issue violated the law, although the judge has not yet determined what additional remedies may be necessary.
The lawsuit was brought by a group of plaintiffs led by the American Federation of Government Employees (AFGE), a union representing federal workers. Filed in February 2025, the case challenged the administration’s decision to permit DOGE personnel to access sensitive information maintained by OPM. The plaintiffs argued that the access violated federal privacy protections and administrative law. Their concerns centered on whether government officials had followed the legal requirements governing the collection, use, and disclosure of personal information held by federal agencies.
OPM is responsible for important aspects of federal workforce administration, including maintaining records connected to government employees. Such records can contain sensitive personal information that requires protection against unauthorized access and disclosure. The federal Privacy Act establishes rules governing how agencies maintain and use records about individuals. It also places restrictions on certain disclosures of personal information. The lawsuit questioned whether OPM had complied with these obligations when it allowed DOGE personnel to examine protected government records.
DOGE was established by President Donald Trump as part of his administration’s effort to reduce government spending, identify inefficiencies, and reorganize federal operations. The initiative attracted considerable attention because of its access to government systems and information, as well as its role in reviewing agency operations. Supporters argued that expanded access could help identify waste and improve efficiency. Critics, however, raised concerns about privacy, oversight, and whether personnel working on government efficiency initiatives were complying with existing laws and agency safeguards.
U.S. District Judge Denise Cote, who oversees the case in the Southern District of New York, concluded that OPM had violated the Privacy Act by granting DOGE agents access to the sensitive information. According to the ruling, there was little meaningful dispute that the access violated the law. The administration’s defense focused largely on changes that had occurred since the lawsuit began, arguing that those developments reduced the need for further judicial intervention. The judge found that the legal violation had occurred, even though the government argued that circumstances had changed.
The court also found that the plaintiffs had prevailed on their claims under the Administrative Procedure Act (APA). This federal law provides a framework for challenging certain unlawful actions by government agencies. The ruling connected OPM’s privacy-law violations to the plaintiffs’ administrative-law claims, strengthening their legal position in the case. The decision is important because it does not simply describe concerns about government data access; it formally recognizes that the conduct challenged by the plaintiffs violated federal law.
The judge had previously issued a preliminary injunction in June 2025 blocking DOGE’s access to the sensitive OPM data at issue. That earlier order sought to prevent the challenged access while the lawsuit continued. The latest ruling builds on the earlier proceedings by addressing the legality of the government’s conduct. It also illustrates how courts can intervene when federal agencies are alleged to have exceeded legal limits or failed to follow statutory protections governing personal information.
Despite the finding of unlawful access, the judge acknowledged that circumstances had changed substantially. DOGE has since been dissolved, and only one of its agents reportedly remains at OPM. The court also noted that no DOGE agent had accessed the sensitive OPM data since September 2025. These developments raise questions about whether additional prospective relief, such as further restrictions or orders designed to prevent future violations, would serve a practical purpose. The judge determined that these changes did not erase the underlying legal violation, but they complicated the question of what should happen next.
The court emphasized that the misconduct arose from the failures of particular individuals to comply with the Privacy Act and the safeguards established by OPM. This distinction is important because the ruling focused on the unlawful access and failures to follow established protections rather than declaring that every activity associated with DOGE was illegal. The judge also observed that even carefully designed safeguards cannot guarantee compliance when individuals responsible for following them disregard their obligations. The decision therefore highlights the importance of both sound privacy policies and effective enforcement.
The case has broader implications for federal employees and other individuals whose personal information is held by government agencies. Federal records may include sensitive details that individuals reasonably expect agencies to protect under applicable law. When agencies permit access without complying with legal requirements, affected people may have grounds to challenge those decisions in court. The ruling reinforces the principle that government efficiency initiatives must operate within existing statutory limits. Administrative goals do not automatically override privacy protections or eliminate an agency’s obligation to follow the law.
Ultimately, the October 20 ruling represents a legal victory for the plaintiffs, but questions about the appropriate remedy remain. The judge’s decision confirms that OPM violated the Privacy Act in allowing DOGE personnel to access sensitive information and that the plaintiffs succeeded on their related administrative-law claims. However, the dissolution of DOGE and the cessation of access may influence whether the court orders further relief. The case serves as a reminder that government agencies must protect personal information, comply with statutory requirements, and ensure that officials entrusted with sensitive records follow the safeguards designed to prevent unlawful access.
Key Legal Outcomes
- Privacy Act violation established: Judge Denise Cote ruled that OPM unlawfully allowed DOGE personnel to access sensitive federal personnel data.
- Plaintiffs prevailed under the APA: The court found that the plaintiffs succeeded on their Administrative Procedure Act claims connected to the privacy violations.
- Earlier injunction restricted access: A June 2025 court order had blocked DOGE’s access to the sensitive OPM information at issue.
- Changed circumstances affect potential remedies: DOGE has been dissolved, and no DOGE agent has accessed the sensitive OPM data since September 2025.
- Further relief remains uncertain: The judge recognized the violations but raised questions about what additional remedies are necessary under the circumstances.
Why It Matters
- Federal employee privacy: The ruling reinforces legal protections for personal information held in government personnel records.
- Government accountability: Federal agencies must follow privacy laws even when pursuing administrative reforms or efficiency initiatives.
- Limits on executive action: Government restructuring efforts remain subject to applicable statutes and judicial review.
- Importance of oversight: Written safeguards must be supported by compliance monitoring and accountability for officials who violate them.
- Long-term legal implications: The case may inform future disputes involving government data access, privacy protections, and agency authority.
