767 F.Supp.3d 44
S.D.N.Y.2025Background
- The Bureau of the Fiscal Service (BFS) at Treasury processes most federal payments and stores sensitive personally identifiable information (PII) and payee financial data used to disburse funds to states and individuals.
- President issued E.O. establishing the Department of Government Efficiency (DOGE) and directed creation of agency DOGE Teams; a Treasury DOGE Team was formed with Thomas Krause (Team Lead) and briefly Marko Elez (technical specialist).
- Treasury approved a 4–6 week Engagement Plan giving the DOGE Team source-code and system access (PAM, SPS, ASAP, CARS) to review and help automate flagging of certain payment files; mitigations (sandbox, encrypted laptop, logging, read-only access) were implemented but not consistently applied.
- Security lapses occurred or were possible: Elez was mistakenly given read/write access to SPS, sent emails outside Treasury (contents unknown), took screenshots, and Treasury was still reviewing logs after his resignation.
- Nineteen states sued under the APA and related theories, seeking emergency TRO and then a preliminary injunction; the court granted a preliminary injunction narrowly barring DOGE-affiliated persons from accessing Treasury payment records/systems containing PII or confidential payee financial data, and ordered Treasury to file a remedial report.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Article III standing (injury and imminence from disclosure of state/payee data) | States: unauthorized access and real risk of future disclosure of PII and state banking data gives concrete, imminent injury supporting injunctive relief | Govt: risk is speculative/attenuated and any harms are not traceable solely to Treasury action | Court: States have standing; unauthorized disclosures and elevated risk are concrete and sufficiently imminent for prospective relief |
| APA finality and arbitrary & capricious review | States: Engagement Plan and implemented access constitute final agency action and were arbitrary and capricious because of rushed, inadequately mitigated process | Govt: no final written action; measures taken mitigated risks; changes were programmatic | Court: Engagement Plan is a final agency action under a pragmatic test; Plaintiffs likely to succeed on arbitrary-and-capricious claim because of hurried implementation and inadequate safeguards |
| Zone-of-interests for statutory claims (Privacy Act, IRC §6103, E‑Government Act, conflict statutes) | States: these statutes protect against improper disclosures and Treasury violated them by sharing access | Govt: States’ asserted interests (state financial data) are not the kinds of individual privacy interests those statutes protect | Court: States lack the required zone-of-interests for most statutory claims (Privacy Act, §6103, E‑Gov Act); those claims are unlikely to succeed |
| Scope of injunctive relief / remedy | States: seek broad injunction banning developing/implementing any process to flag/pause payments and barring non–Senate-confirmed employees access to payment systems | Govt: injunction as proposed is overbroad and unclear; Treasury needs some access for operations and modernization | Court: Issued a narrowly tailored preliminary injunction barring DOGE-affiliated persons from accessing payment records/systems with PII/financial payee data and ordered remedial reporting; refused to enjoin all development of payment-flagging processes |
Key Cases Cited
- TransUnion LLC v. Ramirez, 594 U.S. 413 (2021) (distinguishes standing for retrospective damages from standing for forward‑looking injunctive relief based on risk of future harm)
- Bohnak v. Marsh & McLennan Companies, Inc., 79 F.4th 276 (2d Cir. 2023) (framework for PII‑disclosure injuries: concreteness and imminence; public‑disclosure-of‑private‑facts analogue)
- Lujan v. Defenders of Wildlife, 504 U.S. 555 (1992) (Article III standing elements and limits on programmatic APA challenges)
- Bennett v. Spear, 520 U.S. 154 (1997) (two‑part test for final agency action: consummation and legal consequences)
- Motor Vehicle Mfrs. Ass'n v. State Farm, 463 U.S. 29 (1983) (arbitrary and capricious standard for agency decisionmaking)
- Venetian Casino Resort, LLC v. EEOC, 530 F.3d 925 (D.C. Cir. 2008) (agency adoption of disclosure policy can be final action even if no formal rule)
- Faiveley Transp. Malmo AB v. Wabtec Corp., 559 F.3d 110 (2d Cir. 2009) (preliminary injunctions must be narrowly tailored)