Labor & Employment Law Daily Wrap Up, PRIVACY—D.D.C.: Unions, others, advance in part claims based on DOGE’s access to agency data, (Apr 17, 2025)

By Kathleen Kapusta, J.D.

“This is a dynamic case undergirded by a set of facts evolving before the Court’s eyes.”

Although the AFL-CIO, several unions, a think tank, and two nonprofits, in a case challenging DOGE’s access to data at several federal agencies, adequately stated their ultra vires claim against the U.S. DOGE Service and some claims under the Administrative Procedure Act against the Department of Labor, the Department of Health and Human Services, and the Consumer Financial Protection Bureau, they failed to state a standalone Privacy Act claim, a federal court in the District of Columbia ruled, granting in part and denying in part the defendants’ motion to dismiss without prejudice. In so ruling, the court noted that it is preparing “itself for the twists and turns this case will surely continue to bring” (American Federation of Labor and Congress of Industrial Organizations v. Department of Labor, No. 25-339 (JDB) (D.D.C. Apr. 16, 2025)).

On the day he was inaugurated for his second term, President Trump issued Executive Order 14158, which renamed the United States Digital Service as the United States DOGE Service (USDS) and charged it with “advancing the President’s 18-month DOGE agenda,” including “modernizing Federal technology and software to maximize governmental efficiency and productivity.” The EO also directed agency heads to establish DOGE teams within their agencies and to “take all necessary steps... to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.”

PII. As a result, the plaintiffs allege, USDS personnel have obtained access to systems in DOL and HHS that contain personally identifiable information (PII), including social security numbers, healthcare records, financial information, and information about Medicaid recipients. They also allege that USDS began targeting the CFPB for dismantling and gained access to systems containing, among other things, consumer complaints and mortgage lending practices.

The plaintiffs sued, asserting an ultra vires claim against the USDS, APA claims against DOL, CFPB, and HHS, and a standalone Privacy Act claim against USDS and each agency defendant.

Standing. Moving to dismiss, the defendants first argued that the plaintiffs lacked standing on the face of the complaint. Disagreeing, the court found that the AFL-CIO and the AFGE have associational standing to sue DOL, and AFSCME and SEIU have associational standing to sue HHS. Certain plaintiffs, the court observed, allege that their members are suffering because DOL and HHS have unlawfully given USDS personnel access to agency systems that contain the members’ PII, which constitutes an injury in fact.

Harm. The harm is particularized—the violation of the individual members’ privacy stems from the disclosure of their own PII—and is imminent as they allege that USDS personnel are currently operating at both DOL and HHS, that DOL leadership directed agency employees to give USDS personnel access to “any DOL system,” and that HHS has granted USDS personnel access to CMS and other HHS systems. The court also found that the harm is concrete as it has a close relationship with the harm asserted in a suit for the tort of intrusion upon seclusion.

Congress, the court reasoned, enacted the Privacy Act to “protect the privacy of individuals identified in information systems maintained by Federal agencies.” In effect, said the court, Congress “created a new sphere in which individuals not only expect privacy, but have a right to it—i.e., a sphere of seclusion. As a result. an intrusion upon that sphere—even if the sphere literally encompasses only one row of millions in a dataset—amounts to an injury similar to the intrusion upon other private spheres, such as one’s home.”

As to the defendants’ contention that only dissemination or use of confidential information can give rise to standing, the court explained that an intangible, statutorily created injury is concrete so long as it is akin to a harm traditionally recognized in American courts and here, the plaintiffs’ members’ alleged harms are akin to the traditionally recognized harm seen in the tort of intrusion upon seclusion. Accordingly, the court found that AFL-CIO, AFGE, AFSCME, and SEIU have associational standing to sue DOL and HHS for the agencies’ alleged violations of the APA and Privacy Act.

CFPB. Regarding the plaintiffs’ claims against CFPB for violating the APA and Privacy Act, the court found that the two nonprofits—Virginia Poverty Law Center and Economic Action Maryland Fund—have organizational standing to sue. Each provides “direct services to consumers experiencing difficulties with financial products and services, from mortgages to debt collection to predatory loans” and both allege that the CFPB complaint system is an “irreplaceable tool” for providing direct services to consumers. But that tool, they assert, is only useful if consumers can expect the information they submit to CFPB “will be protected from unlawful disclosure.”

They also allege their injuries are imminent as CFPB leadership has already directed USDS to “begin work on all unclassified CFPB systems,” which includes the systems containing consumer complaints. Thus, said the court, they have standing to sue CFPB for allegedly violating the APA and the Privacy Act.

USDS. The court next found that the same plaintiffs have standing to bring their Privacy Act and ultra vires claims against USDS as they assert the same cognizable injuries for those claims and allege that USDS caused those injuries by seeking access to sensitive systems and by exercising authority it allegedly does not possess.

APA claims. The defendants next argued that the plaintiffs failed to state a cause of action under the APA because they did not seek review of final agency actions. Here, observed the court, the plaintiffs challenge what they allege are unlawful agency defendants’ across-the-board policies to grant USDS personnel access to sensitive record systems (DOGE Access Policies). But the D.C. Circuit, the court noted, has held that such unwritten policies are final agency actions.

Further, the court found the complaint plausibly alleges that each agency has in fact adopted a policy of unlawfully disclosing information without consent. Specifically, the plaintiffs allege that DOL leadership instructed employees “to give [USDS] access to anything they want,” that USDS employees currently on detail to DOL intend to access agency systems; that HHS leadership put out a statement that “two senior HHS employees were leading the collaboration with [USDS], including ensuring appropriate access to CMS systems and technology,” that the agency has provided USDS personnel access to a system that contains individuals’ Medicare accounts receivables, among other things, and that the CFPB Acting Director told staff that USDS could “begin work on all unclassified CFPB systems.” Hence, said the court, the plaintiffs adequately allege a final agency action that each agency defendant has taken.

APA claims for Privacy Act violations. Nor was the court persuaded by the defendants’ contention that the plaintiffs cannot bring APA claims for violations of the Privacy Act because the Privacy Act contains a comprehensive remedial scheme making the remedies it provides adequate and therefore depriving plaintiffs of an APA cause of action. The Privacy Act’s remedial scheme, the court observed, provides for injunctive types of relief, which was the relief requested by the plaintiffs, but only in two instances not present here. Further, in those two instances, the Act provides for damages, not injunctive relief.

Noting that “the question here is whether the APA’s ‘generic cause of action in favor of persons aggrieved by agency action,’ can step into the breach and permit the Court to enjoin agency action alleged to be in violation of the Privacy Act despite the Privacy Act’s failure to authorize such a step,” the court found it “likely can.” An alternative remedy, said the court, “is adequate so as to preclude a cause of action under the APA if, though not ‘identical to relief under the APA,’ it is at least ‘of the same genre.’” And damages and injunctive relief do not belong to the same genre.

Not only did the D.C. Circuit appear to agree that the Privacy Act’s narrow cause of action does not preclude nonmonetary relief under the APA, “the Supreme Court has all but said as much (albeit in dicta),” the court here stated. Accordingly, the court found that the plaintiffs’ “reliance on the Privacy Act did not rob them of an APA cause of action.”

Disclosure. The defendants, however, also argued that the plaintiffs did not adequately allege that the DOGE Access Policies in fact violate the Privacy Act because under the Act agencies can disclose without permission or consent records “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” Though they asserted that USDS personnel are “employees of the agency” defendants and thus the Privacy Act permits the agency defendants to disclose records to them, the court pointed out that the DOGE EO’s terms do not limit an agency’s DOGE Team membership to employees of that agency.

Further, observed the court, the complaint only alleges USDS personnel are detailed to DOL—not HHS or CFPB. So even if the caselaw cited by the defendants confirms that detailees are employees of the receiving agency defendants, the USDS personnel operating at HHS and CFPB would not be, per the complaint, employees of the agencies. “That said,” the court observed, “defendants are not right about the caselaw.”

Moreover, the court stated, the complaint alleges that USDS personnel, not agency leadership, “have directed operations and decisions” at the DOL, HHS, and CFPB; that USDS is determining which DOL, HHS, and CFPB systems its personnel need access to; and that USDS personnel are directing DOL, HHS, and CFPB employees to give them access to those systems. “So the complaint alleges that—even if agency defendant leadership has authorized USDS’s activities, USDS personnel at DOL, HHS, and CFPB are being directed by USDS, not agency, leadership.” Thus, the court found the plaintiffs stated an APA claim that the DOGE Access Policies violate the Privacy Act.

Free-standing Privacy Act claims. Disposing of the plaintiffs’ claims against the defendants under the Privacy Act’s private right of action, the court explained that the plaintiffs, all of which are organizations, do not have a private right of action under the statute.

Ultra vires claim against USDS. Finally, the court addressed the plaintiffs’ claim that USDS’s actions are ultra vires because Congress did not create USDS and thus did not imbue it with the power to direct operations and personnel at the agency defendants. Observing that they allege that USDS has been directing operations and personnel decisions at Congressionally created agencies that Congress has imbued with the authority to exercise specific responsibilities, the court noted that at this stage, it had to accept their allegations as true and the defendants did not point to any legal source that grants USDS the authority to take these actions. Accordingly, the court allowed this claim to proceed for now.

The case is No. 25-339 (JDB).

Judge: Bates, J.

Attorneys: Aman Tewari George (Democracy Forward Foundation) for American Federation of Labor and Congress of Industrial Organizations. Andrew Marshall Bernie, U.S. Department of Justice, for Department of Labor.

Companies: American Federation of Labor and Congress of Industrial Organizations

Cases: Privacy PublicEmployees DistrictofColumbiaNews GCNNews