American Federation of Teachers v. Bessent, 765 F.Supp.3d 482

Plaintiffs are unions and individual federal employees and benefit recipients who allege that their sensitive personal information (PII) held by the U.S. Department of Education (Education) and Office of Personnel Management (OPM) was unlawfully accessed by personnel implementing the Trump Administration’s Department of Government Efficiency (DOGE) agenda under recent executive orders.
Plaintiffs challenge these disclosures under the Administrative Procedure Act (APA), alleging violations of the Privacy Act, arbitrary and capricious agency action, and failure to protect sensitive records from unauthorized disclosure.
Key agency systems at risk include Education’s federal student aid databases and OPM’s personnel databases, which hold a wide array of sensitive PII.
Plaintiffs sought a temporary restraining order (TRO) to prevent further disclosure to DOGE affiliates, specifically targeting Education, OPM, and Treasury.
The Court found that similar TROs had recently been denied concerning other agencies, but that the plaintiffs here established a likelihood of success and irreparable harm sufficient to justify partial injunctive relief against Education and OPM (but not Treasury, where overlapping relief was already granted in another court).

Issue	Plaintiff's Argument	Defendant's Argument	Held
Standing for APA and Privacy Act claims	Plaintiffs face concrete injury by unauthorized disclosure of PII, resembling invasion of privacy.	No injury in fact because no public disclosure or risk of harm; intra-government disclosure is insufficient.	Standing established; unauthorized intra-agency disclosure itself is a cognizable injury.
Final Agency Action & Reviewability	Granting access to DOGE affiliates is final, reviewable agency action; no adequate alternative relief.	No final agency action; an adequate remedy is available under the Privacy Act.	Action is final and reviewable; injunctive relief is not covered by the Privacy Act, so APA review proceeds.
Likelihood of Success: Privacy Act "need-to-know" exception	DOGE affiliates lack a specific need for broad, sweeping access to all plaintiffs’ sensitive PII.	Affiliates are agency employees, thus their access is justified for agency audits and efficiency reforms.	Disclosure exceeds lawful exceptions; most DOGE affiliates likely do not need such access.
Irreparable Harm & Public Interest	Ongoing unauthorized disclosure of PII is actual, imminent, non-monetary harm.	No irreparable harm; government’s policy goals would be hindered by relief.	Plaintiffs face irreparable harm; public interest in protecting PII outweighs administrative goals.

TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (explains concreteness of intangible harms like invasion of privacy for Article III standing)
Bennett v. Spear, 520 U.S. 154 (1997) (establishes test for final agency action under the APA)
Doe v. Chao, 540 U.S. 614 (2004) (Privacy Act only provides damages, not injunctive relief, for improper disclosure)
Garey v. James S. Farrin, P.C., 35 F.4th 917 (4th Cir. 2022) (allegations of privacy invasion from obtaining personal data constitute injury-in-fact)
Krakauer v. Dish Network, L.L.C., 925 F.3d 643 (4th Cir. 2019) (injuries to personal privacy via statutory violation are concrete injuries)
Bigelow v. Dep’t of Def., 217 F.3d 875 (D.C. Cir. 2000) (explains “need to know” exception under the Privacy Act)
Parks v. U.S. IRS, 618 F.2d 677 (10th Cir. 1980) (standing for intra-agency Privacy Act disclosures)