Personal information on millions of federal workers should never have been opened up to a team tasked with cutting government costs, a judge has ruled.
A federal judge ruled Oct. 20, 2026, that giving personnel from the Department of Government Efficiency access to sensitive employee records at the Office of Personnel Management violated the Privacy Act.
What did the judge decide about the Privacy Act?
U.S. District Judge Denise Cote of the Southern District of New York granted final judgment to the plaintiffs in a ruling that runs 39 pages. The case was brought by groups representing federal workers who argued that their personal information was exposed without proper safeguards. The court had earlier blocked further disclosures to the team while the case moved forward.
She found that the access broke the Privacy Act, which bars certain disclosures of records and requires safeguards when other records are shared.
The judge wrote that the government barely defended whether the access was legal under the Privacy Act. Instead, she said, it relied on later developments to argue the case was moot and that further court orders were unnecessary.
Why did DOGE want the data?
Justice Department lawyers argued that DOGE needed the records as part of an effort to modernize government computer systems. The team, made up of outside technologists and political appointees, was given broad access to agency systems early in the administration.
According to the judge, the government never explained why that modernization work required access to records containing personal identifying information.
Lawyers also said the team was given access in case it needed the data later. The ruling found the government never tied that access to any of the team’s actual duties. Privacy experts have long warned that granting access to sensitive data without a clear purpose increases the risk of misuse or exposure.
The Justice Department did not respond to a request for comment.
What information does OPM hold?
The Office of Personnel Management manages human resources for the federal workforce. Its systems contain detailed records on millions of current and former federal employees, including Social Security numbers, addresses, salaries and job histories.
The agency suffered a major breach in 2015, when hackers stole data on more than 21 million people, making the security of its records a concern for years. That breach exposed fingerprint records and background check files, and it was linked to hackers based in China.
What is the Privacy Act?
Congress passed the Privacy Act in 1974 after the Watergate scandal to limit how federal agencies collect, use and share personal records.
The law generally prevents agencies from disclosing records about individuals without their consent, with certain exceptions, and allows people to sue when their rights are violated.
It has become a central legal tool in challenges to the administration’s data practices, including a recent lawsuit over federal efforts to compile voter data. Voting and privacy groups filed that suit against the Department of Homeland Security this month.
What does the Privacy Act ruling mean for DOGE?
DOGE was created at the start of President Donald Trump’s second term to cut spending and overhaul federal technology. Its efforts to gain access to sensitive government data sparked lawsuits across the country. Billionaire Elon Musk led the effort in its early months before stepping away in 2025.
The ruling adds to legal setbacks over how the team handled personal information. The government could appeal. Administration officials have argued that DOGE’s work was lawful and aimed at rooting out waste and fraud.
For federal workers, the Privacy Act decision offers a formal finding that their data was shared improperly. What remedies follow may depend on future proceedings.
