Labor & Employment Law Daily Wrap Up, REMEDIES, DAMAGES—4th Cir.: Preliminary injunction barring Education, OPM, Treasury from disclosing PPI to DOGE affiliates vacated, (Aug 13, 2025)

By Kathleen Kapusta, J.D.

“To insist that the DOGE affiliates explain in advance the exact information they need and why is to demand something just short of clairvoyance.”

Vacating a preliminary injunction barring three federal agencies—the Department of Education, Department of Treasury, and OPM—from disclosing records with employees’ sensitive personal information to government personnel affiliated with DOGE, a divided Fourth Circuit found the plaintiffs—five professional organizations and six individuals—failed “by a decent margin” to show they would likely prevail on all of the issues combined in their lawsuit claiming the defendants violated the APA by not acting in accordance with the Privacy Act. Dissenting, Judge King “would reject the panel majority’s heightened standard and affirm the district court’s Preliminary Injunction as a proper application of the entire four-factor Winter test” (American Federation of Teachers v. Bessent, No. 25-1282 (4th Cir. Aug. 12, 2025)).

In accordance with President Trump’s January 2025 Executive Order 14158 directing the modernizing of “Federal technology and software to maximize governmental efficiency and productivity” in executive agencies, the Department of Education, Department of Treasury, and OPM quickly created DOGE Teams staffed with their own employees as well as plans to give the teams high-level IT access to their systems. Shortly thereafter, the plaintiffs—unions and membership organizations representing current and former federal employees and federal student aid recipients, and six military veterans who have received federal benefits or student loans—sued, alleging that they or their members have personally identifiable information housed in the agencies’ databases and that disclosing the information to the agencies’ DOGE-affiliated employees would violate both the Privacy Act and the Administrative Procedure Act (APA).

Prior proceedings. They sought to enjoin the agencies from granting IT access to the DOGE affiliates. The district court granted their motion for a TRO and a month after that, it granted the plaintiffs’ motion for preliminary injunction against all three agencies. The Fourth Circuit subsequently granted the government’s motion to stay the preliminary injunction pending appeal.

As this appeal was pending, the Fourth Circuit observed, the Supreme Court stayed the preliminary injunction in a related case involving nearly identical Privacy Act and APA claims brought against the Social Security Administration and its DOGE-affiliated employees.

Multiplicative problem. Turning to the case at hand, the appeals court noted that the plaintiffs faced a “multiplicative problem” as their “likelihood of success overall is the product of their probability of success on each of the independent, dispositive issues.” Pointing out that the same problem played a role in its decision to grant the government’s motion for a stay pending appeal, the court explained that its “full consideration these last few months has only deepened our preexisting concerns with Plaintiffs’ likelihood of success” as the “number of obstacles Plaintiffs must surmount remains unchanged, and further briefing has only highlighted their arguments’ weaknesses.”

Standing. First and foremost, observed the court, the plaintiffs seemingly lack standing. In an attempt to allege an injury with a “close relationship to harms traditionally recognized as providing a basis for lawsuits in American courts,” they argued that the disclosure of their records to DOGE representatives was a violation of the Privacy Act, which bore a close relationship to the harm inflicted by the common-law tort of intrusion upon seclusion. “But intrusion upon seclusion,” the court stated, “has long been understood to guard not against the disclosure of sensitive information as such, but against the feeling of unease when and where one should ideally be at peace.” Further, the court stated, “it is not the information obtained, but the knowledge that a third party is engaged in targeted snooping, that causes the harm.”

Finding that harm was not present here, the court pointed out that each plaintiff’s information was one row in various databases that are millions upon millions of rows long. Nor did the plaintiffs allege that any particular row of information belonging to any particular plaintiff was even examined. Moreover, said the court, unauthorized knowledge of sensitive information is more closely shielded by other privacy torts that require disclosure to the public at large and the plaintiffs alleged no public disclosure.

Garey and Krakauer. Though the district court relied on the Fourth Circuit’s 2022 decision in Garey v. James S. Farrin, P.C., in finding that intrusion upon seclusion served as a sufficiently close common-law analog, the appeals court explained that “to understand the holding in Garey, we must understand the analysis in” Krakauer v. Dish Network, LLC, its 2019 decision in which it recognized that unwanted calls injured the plaintiffs by intruding upon their personal privacy in the home. “Given Garey’s repeated reliance on Krakauer,” said the court, “we cannot sensibly read Garey to hold that the unauthorized acquisition of information itself—which is nowhere to be found in Krakauer—suffices for standing under TransUnion.” Accordingly, the court found that the plaintiffs here did not appear to have standing.

Final agency action. The court next pointed out that for their APA claim, the plaintiffs had to seek review of a final agency action and the agency action at issue here was granting IT access to certain employees. The plaintiffs relied on Venetian Casino Resort, LLC. v. EEOC, in which a casino sued the EEOC over its information-disclosure policy that permitted the Commission to release documents purportedly containing trade secrets without first notifying the purported owners of the trade secrets. Accepting the policy as a final agency action, the D.C. Circuit allowed the case to go forward.

Though the Fourth Circuit found this case superficially resembled Venetian Casino in that both cases concern information disclosures, the “disclosure policy in Venetian Casino,” it explained, “was long-running, agency-wide, conceded to exist by agency counsel, and expressly written down in the agency’s formal Compliance Manual—four crucial features all missing from this case.” Given the lack of clear precedent in this area, the court found it “unlikely the district court could so definitely find final agency action here.”

APA cause of action. Finding another hurdle for the plaintiffs in the APA, the court pointed out that the statute only permits plaintiffs to sue over final agency actions “for which there is no other adequate remedy in a court.” As a result, it observed, it would have to conclude that the Privacy Act’s own scheme of review does not provide an “adequate remedy.” But the Privacy Act, said the court, allows plaintiffs to seek “Civil Remedies” for four enumerated kinds of agency violations, grants “jurisdiction” to the district courts only for those violations, and specifies the precise relief that can be sought for each of the four violations.

“With its enumerated violations and details on jurisdiction, venue, and timing, the Privacy Act at least plausibly reflects Congress’s intent to preclude suit under the APA in circumstances like those presented here,” the court reasoned. While both the Fourth Circuit and the Supreme Court have implied in footnotes that the Privacy Act does not preclude suits seeking equitable relief under the APA, those footnotes are dicta, stressed the court, and the Supreme Court has more recently reserved the question. “In the absence of binding precedent, answering this question does not strike us as a trivial task. So Plaintiffs have yet another obstacle in their way.”

Privacy Act violation. And even if the plaintiffs could overcome these threshold issues, the court found it unlikely they could establish a Privacy Act violation as the Act allows records to be shared intra-agency with “those officers and employees of the agency . . . who have a need for the record in the performance of their duties.” And the broader an employee’s duties, the court reasoned, the broader their needs.

Observing that the DOGE-affiliated agency employees were tasked with a broad and open-ended duty, the court found it did “not stretch the imagination to think that an employee tasked with modernizing an agency’s software and IT systems would require administrator-level access to those systems, including any internal databases, especially when conducting the initial survey of the agency’s technological ailments.”

While the court noted that it did not hold with certainty that the plaintiffs lack standing, that they have not challenged final agency action, that they cannot sue under the APA, or that the DOGE affiliates’ IT access falls into the Privacy Act’s need-to-know exception, it found they “failed, by a decent margin, to show that they will likely prevail on all of these issues combined.” Thus, it vacated the district court’s order granting the plaintiff’s motion for a preliminary injunction.

King dissent. Dissenting, Judge King asserted that the lower “court acted quickly—but extremely carefully—in temporarily barring the defendant federal agencies and officials from disclosing the plaintiffs’ personally identifiable information to DOGE and its affiliates, first by a temporary restraining order, and then by the preliminary injunction and accompanying 68-page memorandum opinion at issue in this appeal.”

“Contrary to the panel majority,” King continued, “the district court did exactly what it was obliged to do. Specifically, in its thorough and cogent Opinion, the district court separately assessed the plaintiffs’ likelihood of success on the contested merits issues—i.e., whether the plaintiffs possess Article III standing to pursue their APA claim, whether there was a final agency action for purposes of APA jurisdiction, whether the APA claim is otherwise precluded by the existence of an adequate remedy under the Privacy Act, and whether the Privacy Act’s need-to-know exception renders lawful the disclosure of personally identifiable information to DOGE.” It then found that the plaintiffs established a likelihood of success overall.

Finally, he noted that “similar questions about the applicable standard, the likelihood of success on the merits, and the other Winter factors are set to be considered and decided by our en banc Court in appeal No. 25-1411, American Federation of State, County & Municipal Employees v. Social Security Administration (the “SSA case”), concerning DOGE’s access to Social Security records containing the highly sensitive personal information of essentially everyone in our Country.”

The case is No. 25-1282.

Judge: Richardson, J.

Attorneys: Jack E. Starcher, U.S. Department of Justice, for Scott Bessent, U.S. Department of the Treasury, Charles Ezell, Linda McMahon, U.S. Office of Personnel Management, U.S. Department of Education. Carson Scott (Munger, Tolles & Olson), Mark Hanna (Murphy Anderson, and Kristy Parker (Protect Democracy Project) for American Federation of Teacher, International Association of Machinists and Aerospace Workers, National Active and Retired Federation of Federal Employees, National Federation of Federal Employees, Donald Martinez, Jason Cain, Thomas Fant, Christopher Purdy, Kristofer Goldsmith, International Federation of Professional & Technical Engineers.

Companies: American Federation of Teachers; International Association of Machinists and Aerospace Workers; National Active and Retired Federation of Federal Employees; National Federation of Federal Employees; International Federation of Professional & Technical Engineers

MainStory: TopStory RemediesDamages PublicEmployees Privacy Labor UnionsMembers DOGE FedTracker LaborEmployment MarylandNews NorthCarolinaNews SouthCarolinaNews VirginiaNews WestVirginiaNews GCNNews