786 F.Supp.3d 647
S.D.N.Y.2025Background
- On and after Jan. 20, 2025, OPM granted at least 20 individuals associated with the new "DOGE" program administrative access to multiple OPM systems that contain highly sensitive PII (eOPF, EHRI, USA Staffing, USAJOBS, FEHB, etc.).
- Many DOGE assignees received expedited or temporary appointments; onboarding was irregular: background checks were incomplete or waived, required cyber/privacy training was delayed or provided without quizzes, and ordinary admin accounts for career DBAs were briefly revoked.
- Some DOGE assignees logged into OPM systems; other data was extracted for use (e.g., to build GWES) by career OPM staff and provided to DOGE personnel. OPM produced audits (February and March) showing access grants and logins but with discrepancies and gaps.
- Plaintiffs (current/former federal employees and unions) sued OPM and DOGE-related defendants under the Privacy Act and the APA, seeking a preliminary injunction to bar disclosure to DOGE agents, compel safeguards, and require destruction/impoundment of improperly obtained copies.
- The court found plaintiffs likely to succeed on Privacy Act claims (illegal disclosure under §552a(b) and failure to establish safeguards under §552a(e)(10)), and on APA reviewability and arbitrary-and-capricious grounds; it also found Article III standing (harm analogous to intrusion upon seclusion) and irreparable harm, favoring injunctive relief.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing for Privacy Act/APA claims | Unauthorized access to sensitive OPM records is a concrete, particularized injury analogous to intrusion upon seclusion; future risk is imminent | No actual injury because few DOGE agents logged in; speculative future harm; presumption of regularity in vetting | Standing established: disclosure itself (and increased breach risk) is a concrete injury; risk of future harm supports imminence |
| §552a(b) — unlawful disclosure exception ("need to know") | DOGE agents lacked a demonstrated need; grants were anticipatory and unusually broad (administrative access) | Access was lawful because individuals were (or became) OPM employees or properly detailed and thus had need; presumption of regularity | Likely violation: many DOGE grants exceeded need; some assignees were likely non-OPM or primarily detailed elsewhere and thus disclosure violated §552a(b) |
| §552a(e)(10) — duty to safeguard records | OPM ignored established vetting, training, and least-privilege controls, increasing confidentiality/integrity/availability risks | OPM followed established procedures; security controls (e.g., MFA) in place | Likely violation: OPM departed from required safeguards (training waived/delayed, administrative access broadly granted), creating serious security risk |
| APA reviewability / final agency action & remedy | OPM’s collective decision to grant broad access and bypass procedures was final and subject to APA review; Privacy Act remedies are inadequate for injunctive relief | Actions were discrete personnel decisions (not final agency action); Privacy Act remedies preclude APA relief | APA claims reviewable: conduct was final agency action and APA provides relief because Privacy Act does not supply adequate injunctive remedy |
Key Cases Cited
- TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (concrete, intangible harms and standing for disclosure of private information)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (Article III standing framework)
- Spokeo, Inc. v. Robins, 578 U.S. 330 (2016) (concreteness requirement for intangible injuries)
- Caro v. Weintraub, 618 F.3d 94 (2d Cir. 2010) (intrusion-upon-seclusion tort: injury from unauthorized interception/access itself)
- Bennett v. Spear, 520 U.S. 154 (1997) (final agency action test for APA reviewability)
- Whitman v. American Trucking Associations, 531 U.S. 457 (2001) (broad definition of "agency action" under APA)
- Mullins v. City of New York, 626 F.3d 47 (2d Cir. 2010) (use of hearsay at preliminary-injunction stage)