Court Rules OPM's Disclosure of Federal Employee Records to DOGE Unlawful

• A federal court in New York ruled on October 20, 2026, that the Office of Personnel Management (OPM) violated the Privacy Act by sharing millions of federal employee records with DOGE agents.
• The court found OPM in breach of two key provisions: one restricting data disclosure between agencies and another mandating the protection of record security and confidentiality.

Context of the Ruling

• Starting in January 2025, OPM provided the U.S. DOGE, led by Elon Musk, with access to databases containing sensitive personal information of millions of employees, retirees, and applicants.
• The Electronic Frontier Foundation (EFF) sued OPM and DOGE on behalf of federal unions and individual employees, alleging violations of the 1974 Privacy Act.
• Judge Denise Cote declared the data sharing unlawful, noting that there was no evidentiary support for OPM's claim that the access was necessary for a modernization agenda.

Current Status and Implications

• While many DOGE agents have since left the government and OPM has revoked their access, the court recognized the need for remediation regarding the created security risks.
• The court will issue a ruling on specific remedies for the data exposure at a later date.
• EFF continues to advocate for OPM to rectify the cybersecurity vulnerabilities resulting from this disclosure.