Labor & Employment Law Daily Wrap Up, PRIVACY—S.D.N.Y.: Federal employees advance in part their claims against DOGE based on accessing their personal information, (Apr 4, 2025)

By Kathleen Kapusta, J.D.

“Clearly, the complaint alleges more than a passive grant of access; it plausibly pleads that the DOGE agents actually exploited their access to review, possess, and use OPM records.”

A federal district court in New York granted in part OPM and DOGE’s motion to dismiss the APA and Privacy Act claims brought by current and former government employees and two unions who alleged that data contained in OPM databases, including the employees’ personally identifiable information, was improperly disclosed to DOGE agents. Although the court found the plaintiffs could not obtain declaratory or injunctive relief for the Privacy Act claims they alleged, and they sought no monetary damages, the court found they could seek that relief through the APA and they adequately pled their APA claims (American Federation of Government Employees, AFL-CIO v. U.S. Office of Personnel Management, No. 25cv1237 (DLC) (S.D.N.Y. Apr. 3, 2025)).

On January 20, 2025, President Trump signed Executive Order 14,158, which established the Department of Government Efficiency (DOGE) to implement his DOGE agenda “by modernizing Federal technology and software to maximize governmental efficiency and productivity.” Each executive agency was instructed to establish a DOGE team and agencies were instructed to ensure, “to the maximum extent consistent with law,” that DOGE has “full and prompt access to all unclassified agency records, software systems, and IT systems.”

Lawsuit allegations. Alleging that OPM gave at least six DOGE agents immediate access to all OPM personnel systems, including systems that maintain personal and employment information of tens of millions of current and former federal employees, contractors, and job applicants, the plaintiffs sued OPM and DOGE under the Privacy Act and the Administrative Procedure Act. They claimed that at the time DOGE agents were given access to these systems, they had not been properly vetted, had not received customary security clearances, and had not received OPM’s security training. They also described harms they fear they may suffer from the disclosure of OPM records to the DOGE agents, including an increased vulnerability of their personal data to cyberattacks, hacking, and identity theft.

The plaintiffs sought a TRO. The defendants requested the motion be converted into one for a preliminary injunction and the plaintiffs joined in this motion. The defendants then moved to dismiss the complaint.

Standing. The defendants first argued that the plaintiffs lacked Article III standing to bring their claims. After noting that the unions sought only to assert their members’ injuries, the court found the plaintiffs sufficiently established standing. Specifically, said the court, “the complaint adequately alleges that the individual plaintiffs and members of the plaintiff unions have experienced a concrete injury in fact that is analogous to the tort of intrusion on seclusion.”

Here, the court noted that the records at issue include Social Security numbers, health history, financial disclosures, and information about family members, which the plaintiffs have every reason to expect would be carefully guarded, and which they allege were disclosed in a rushed and insecure manner that departed from OPM’s normal practices. Further, they contend, the DOGE agents were not vetted, were not required to obtain security clearances, and were not trained about OPM security protocols.

“As alleged,” the court stated, “this intrusion upon the individual plaintiffs’ private affairs and confidential information was a substantial invasion of their privacy and would be highly offensive to a reasonable person.” The plaintiffs’ allegation of ongoing unauthorized access by the DOGE agents to their data was sufficient to meet the injury in fact requirement, the court concluded.

Further, said the court, the plaintiffs plausibly alleged the defendants caused their injuries. They asserted that OPM, which was responsible for the safekeeping of their records, disclosed those records to DOGE agents without requiring the agents to be appropriately vetted or trained, and without limiting their access in the ways required by the Privacy Act. Accordingly, the court found they plausibly pleaded an injury in fact caused by the defendants’ illegal behavior, which may be redressed through a declaration and injunction.

Illegal disclosure. The plaintiffs next argued that OPM violated the Privacy Act, and is continuing to do so, by disclosing its records to DOGE. They relied on two provisions that prohibit certain disclosures of records and impose a duty to establish appropriate safeguards to ensure the security and confidentiality of records. While they argued DOGE did not have a need for the records in the performance of any lawful duty it may have at OPM or elsewhere in the federal government, the defendants pointed to an exception to the Privacy Act that permits disclosure “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.”

Finding that the plaintiffs plausibly alleged a violation of the Privacy Act provision prohibiting disclosure of certain records, the court pointed to allegations that OPM maintains a system of records, as defined by the Privacy Act, and that it disclosed those records without the written consent of the individuals to whom those records pertained. They plaintiffs also alleged that the exception did not permit the disclosures because they were made to DOGE agents who were not officers or employees of OPM and, even if the DOGE agents were employees of OPM, they did not have a need for those records in the performance of any lawful duty.

For their part, the defendants argued that the plaintiffs did not plausibly plead that the DOGE agents were not OPM employees at the time they demanded and received access to OPM records. Though the court agreed that for purposes of the applicability of the exception, “it will be relevant at some point in this litigation to determine whether, at the time they were first given access to OPM records, the DOGE agents were OPM employees,” it explained that the issue for now was whether the plaintiffs plausibly pled a claim.

Noting complaint allegations that “Musk and other DOGE actors were not government employees at the time they demanded and received access to the OPM computer networks,” that many of the DOGE agents who were given access to OPM records were under the age of 25 and “until recently” were employees of Musk’s private companies, that the ordinary clearance and training procedures were not followed before the DOGE agents accessed the OPM records, and that DOGE and its Temporary Organization, which were directing the work of the DOGE agents, are components of the Executive Office of the President and thus entirely separate entities from OPM, the court found this sufficed to find they plausibly pled that DOGE agents who were given access to OPM records were not OPM employees.

Need to review. The defendants also argued that the plaintiffs failed to plead that any DOGE agents who were employees of OPM did not have a need to review the OPM records. But the plaintiffs’ conclusory assertion, said the court, that no exception to the Privacy Act covers DOGE’s access to records held by OPM and that the OPM records were disclosed to DOGE agents who did not have “a lawful and legitimate need” for such access, was enough to adequately plead a claim.

Lack of appropriate safeguards. Regarding the plaintiffs’ second Privacy Act claim, in which they alleged the defendants violated their duty to safeguard the plaintiffs’ records, the court noted that they pled that OPM did not establish security vetting and training for the DOGE agents before they were given such access and the defendants did not specifically address this claim.

No injunctive relief. Although the plaintiffs plausibly pled their Privacy Act claims, the court pointed out that individuals may obtain injunctive relief under the Act in only two circumstances—courts may order agencies to amend an individual’s records or to give an individual access to their own records. “Accordingly, the plaintiffs may not obtain declaratory or injunctive relief under the Privacy Act for the violations they have alleged here,” the court concluded.

APA claims. Turning to the plaintiffs’ APA claim alleging that the defendants’ actions were contrary to law because they violated the Privacy Act, the court found the complaint adequately alleged a violation of the Privacy Act and thus it adequately alleged that the defendants’ actions were “not in accordance with law.”

The plaintiffs also adequately alleged that OPM violated the APA by acting in an arbitrary and capricious manner as they assert that OPM’s decision to give multiple DOGE agents immediate and unrestricted access to its records was a gross departure from its longstanding practice of carefully vetting individuals who receive access, making sure they obtain customary security clearance, and providing them with the appropriate security training. OPM, they argued, took these actions despite the Executive Order’s instruction that it “shall be implemented consistent with applicable law” and that DOGE shall “adhere to rigorous data protection standards.”

The complaint also adequately alleged that OPM engaged in a final agency action when it abruptly changed its longstanding practices by giving access to sensitive and legally protected records in violation of those practices, federal statutes, and even the terms of the DOGE Executive Order.

And while the defendants argued that the APA is unavailable to the plaintiffs because the Privacy Act provides an “adequate” remedy, the court again pointed out that the Privacy Act does not provide injunctive or declaratory relief for the claims at issue here and the plaintiffs did not seek monetary damages.

As to the defendants’ contention that the plaintiffs had no right to injunctive relief under either the Privacy Act or the APA, the court noted that the Privacy Act explicitly provides for injunctive relief in two circumstances, while being silent regarding other circumstances, which does not establish that Congress intended to preclude judicial review of APA claims alleging violations of the Privacy Act’s substantive provisions or arbitrary and capricious actions by OPM that strike at the privacy concerns that drove the enactment of the Privacy Act. Nor did the defendants identify any comparable cases in which injunctive relief that was ruled to be unavailable under the Privacy Act was also not available under the APA.

Ultra vires. Finally, the court found the plaintiffs adequately pled their ultra vires claim against DOGE alleging that no law permitted it to access and administer OPM systems. They alleged a massive disclosure of the OPM records of tens of millions of Americans to unvetted and untrained individuals who had no legal right to access those records, in wholesale disregard of the Privacy Act. They further pled that this intrusion was directed and controlled by DOGE, and that DOGE has no statutory authority with respect to OPM records and thus the actions were “blatantly lawless.”

Accordingly, the court granted the defendants’ motion to dismiss the Privacy Act claims except insofar as they are a predicate to the other claims.

The case is No. 25cv1237 (DLC).

Judge: Cote, D.

Attorneys: F. Mario Trujillo, Electronic Frontier Foundation, Rhett O. Millsaps II, Lex Lumina LLP, Norman L. Eisen, State Democracy Defenders Fund, and Subodh Chandra (The Chandra Law Firm) for American Federation of Government Employees and Association of Administrative Law Judges, International Federation of Professional and Technical Engineers Judicial Council 1. Jeffrey Oestericher for United States Attorney’s Office, Southern District of New York.

Companies: American Federation of Government Employees; Professional and Technical Engineers Judicial Council 1

Cases: Privacy Procedure PublicEmployees RemediesDamages FedTracker LaborEmployment DOGE NewYorkNews GCNNews