Federal judge grants preliminary injunction in challenge to DOGE record access at OPM

U.S. officials violated federal privacy law and flouted cybersecurity protocol in sharing Office of Personnel Management records with DOGE affiliates, a federal district court judge in New York ruled Monday, granting a request for a preliminary injunction against the administration.

In a 99-page order, Judge Denise Cote of the U.S. District Court for the Southern District of New York concluded that federal worker and union plaintiffs had shown that the government defendants in the challenge shared OPM records with “individuals who had no legal right of access to those records” in violation of the Privacy Act of 1974 and cybersecurity standards. 

“This was a breach of law and of trust,” Cote said. “Tens of millions of Americans depend on the Government to safeguard records that reveal their most private and sensitive affairs.”

The ruling is the latest in a challenge to DOGE’s data access at OPM brought by a coalition of federal unions and current and former government employees or contractors. In a lawsuit filed Feb. 11, those plaintiffs alleged that OPM and its acting Director Charles Ezell had provided DOGE affiliates with personnel records in violation of the Privacy Act and federal administrative procedure law, and asked the court to prevent further disclosure of that information and order the deletion of that data.

While Cote granted the preliminary injunction Monday, a separate order outlining the scope of that injunction is still forthcoming. The parties are ordered to discuss terms of the injunction and file proposals with the court by Thursday.

Nonetheless, the ruling marks a win for those challenging the Trump administration after a deluge of recent legal victories for the DOGE. On Friday, the Supreme Court allowed the White House unit to access Social Security Administration records and shielded it from handing over information about its operations. Last month, a federal court also permitted the efficiency-bent group to access Department of Treasury systems.

In her ruling, Cote acknowledged the government’s arguments that an injunction would hinder its ability to carry out administration policy, such as modernizing IT systems at OPM, but she said the “litigation does not challenge or undermine that policy.”

“The modernization of IT systems has been an uncontroversial goal of the Government for years,” Cote said. “The defendants have not shown that a modernization effort will be hampered by compliance with the mandates of the Privacy Act or adherence to OPM’s established cybersecurity protocols.”

The plaintiffs are represented by Electronic Frontier Foundation, Lex Lumina LLP, Democracy Defenders Fund, and The Chandra Law Firm, who hailed the ruling as a “victory for personal privacy” in emailed press releases. 

The government defendants — which include OPM, Ezell, Elon Musk, the U.S. DOGE Service, and the acting administrator of the DOGE — are represented by Department of Justice attorneys. The DOJ didn’t immediately respond to a request for comment.