Judge Rules OPM Broke the Privacy Act for DOGE, Then Leaves Open Whether Anything Is Left to Order

A federal judge in Manhattan ruled on October 20 that the Office of Personnel Management broke the Privacy Act when it gave people working on the DOGE agenda broad access to systems holding personal data on tens of millions of past, current and aspiring federal employees. Judge Denise Cote ordered nothing in response. The permissions the plaintiffs wanted set aside have already been rescinded, and whether any relief is still needed stays open.

What the opinion holds

The ruling rests on two sections of the statute. Section 552a(b) bars an agency from disclosing a person's records without consent, with an exception for agency employees who have a need for the record in the performance of their duties. Section 552a(e)(10) requires an agency to set up safeguards for the security and confidentiality of records. Cote found OPM failed both, and wrote that the defendants "barely defend" the legality of the grants, relying instead on later events to argue mootness.

The record she relied on is specific. Starting January 20, 2025, OPM gave DOGE-affiliated people access to at least fourteen systems, most containing personal information. An OPM audit counted twenty such individuals granted access through March 6, almost all administrative, and few ever logged in. Gregory Hogan, then OPM's chief information officer, testified that a request for access can be satisfied within minutes, which undercut the idea that access had to be granted in advance. He and acting director Charles Ezell described the grants as anticipatory, and the court held that does not meet the statute's need standard.

The government argued that DOGE's modernization mandate justified broad access. Cote cited testimony from plaintiffs' expert David Nesting, a former OPM deputy CIO, who modernized systems at two agencies without touching personal data in them, and found no contemporaneous explanation tying any individual's duties to the access granted.

Why the case survives, and why that may not decide the remedy

The mootness argument was not weak. All but one DOGE agent has left OPM, no agent has had access to the personal-data systems since September 2025, and the DOGE Temporary Organization expired on July 4, 2026. Cote gave the expiry particular weight because the executive order fixed that date. But the same order still directs agencies to give the U.S. DOGE Service "full and prompt access" to unclassified records, and that directive remains in effect.

The rest of OPM's cleanup tracked the court calendar. OPM removed permissions for Riccardo Biasini, Akash Bobba and Nihkil Rajpal between July 21 and July 30, 2025, shortly before an August 1 report to the court. It circulated a revised policy on November 20, days before the mootness motion was due. Adam Starr, its third CIO since the suit began, disavowed the anticipatory-access rationale for administrative access in a July 6 declaration and extended that to all access on July 28, after the plaintiffs pointed out the gap. Cote called OPM's conduct "undoubtedly commendable" while finding it appeared designed to avoid judicial review.

“even the most rigorous procedures cannot secure compliance by those willing to disregard them.”

Mootness and injunctions carry different burdens, and that is where the government may recover ground. Cote wrote that voluntary cessation, though it fails to moot a case, remains an important factor on whether an injunction is warranted, and plaintiffs must show some cognizable danger of recurrence.

What is still unresolved

OPM says it checked. A review run by its own CIO office from May 18 to June 5, 2026 covered audit, access, download and export logs from January 2025 through June 5, 2026, and Starr's declarations say it found no evidence that agents copied or sent records outside OPM systems, so OPM concluded no remediation was warranted. That is OPM auditing itself. The opinion notes that OPM's annual security audit never mentioned the DOGE grants, and that audits by the Government Accountability Office and OPM's inspector general were still pending in March.

One person is also unsettled. Noah Peters is the last DOGE agent at OPM. Three government declarations, including his own, say he has been an OPM employee throughout. The plaintiffs cite a roster the government filed in a separate case listing him as a detailee to the DOGE service from January 24, 2025. The opinion records the dispute without resolving it.

The government also leaned on a Fourth Circuit panel decision, American Federation of Teachers v. Bessent, reasoning that broad duties can justify broad access. The opinion notes the full court later vacated it, and adds that even on that premise, need depends on the duties actually performed. Bloomberg Law reported the ruling the same evening, and the Electronic Frontier Foundation, which represents the plaintiffs, posted the opinion.

The court will now ask both sides what relief is appropriate, and the answer determines whether a finding of unlawful access binds OPM going forward. This piece found no data on how often courts withhold a permanent injunction once an agency rescinds the challenged conduct, so it makes no claim about how unusual that would be.