Labor & Employment Law Daily Wrap Up, REMEDIES, DAMAGES—D.D.C.: Court refuses to enjoin OPM from operating its ‘government-wide email system’, (Feb 18, 2025)

By Kathleen Kapusta, J.D.

The plaintiffs alleged that OPM’s failure to prepare a meaningful Privacy Impact Assessment before adopting a new email system left vast amounts of private information, including government email addresses of millions of individuals, at risk of disclosure.

Two federal executive branch employees and five other individuals who sued the Office of Personnel Management (OPM) in a putative class action alleging that it violated the E-Government Act when it implemented a new “Government-Wide Email System,” or GWES, without first preparing a Privacy Impact Assessment (PIA), failed in their renewed attempt to obtain a TRO barring OPM from operating “any computer systems connected to the HR@opm.gov address... prior to the completion and public release of a required Privacy Impact Assessment.” Not only did the plaintiffs fail to show they have a substantial likelihood of standing based on their asserted injuries, they failed to show the injuries were certain enough and great enough to warrant preliminary injunctive relief, a federal court in the District of Columbia concluded (Doe v. Office of Personnel Management, No. 25-234 (RDM) (D.D.C. Feb. 17, 2025)).

Single email address. Just days after President Trump’s inauguration, OPM announced that it was “testing a new capability allowing it to send important communications to ALL civilian federal employees from a single email address,” HR@opm.gov. It subsequently sent several emails to large swaths of the executive branch workforce, as well as, apparently, members and staff of the federal judiciary, government contractors, state employees with.gov email addresses, and employees of agencies in the legislative branch.

OPM launched this effort all without conducting a PIA in advance, as required by Section 208 of the E-Government Act. Pursuant to guidance later issued by the Office of Management and Budget, “[n]o PIA is required where information relates to internal government operations,” including when information is collected “for government-run... IT systems... to the extent that they do not collect or maintain information in identifiable form about members of the general public.”

First TRO motion. The two federal employees sued OPM on January 27 alleging it was acting in violation of Section 208. On February 4, they filed a motion for a TRO. In its response, OPM attached a “Privacy Impact Assessment for Government-Wide Email System (GWES),” dated February 5. The following day, the court held a hearing and denied the plaintiffs’ motion as moot because OPM had conducted the PIA and the relief sought by them was not meaningful.

Renewed motion. The plaintiffs then filed an amended complaint in which they added five new plaintiffs who had a.gov email address but did not work in the executive branch of the U.S. government and also challenged the adequacy of the OPM’s PIA. They also filed a renewed motion for a TRO. They based their motion on two alleged injuries: (1) they are suffering an ongoing injury simply because their “information [is] being stored in an insecure system,” and (2) their information is “more vulnerable to hacking because it is in a system that is vulnerable to hacking.”

Standing. Noting that its “inquiry begins and ends with Plaintiffs’ asserted injuries,” the court first found the plaintiffs failed to show they had a substantial likelihood of standing based on either injury. Citing the U.S. Supreme Court’s 2021 decision in TransUnion LLC v. Ramirez, the court noted that in a case like this where there is no alleged constitutional violation, the plaintiffs must identify “a close historical or common-law analogue for their asserted injur[ies].”

And here, said the court, neither of the identified injuries were enough, at this stage of the proceedings, to confer Article III standing. As to their first alleged injury, the mere fact that their.gov email addresses are being stored on an allegedly unsecured system is not concrete or actual. Further, the court observed, rather than identify any common-law analogues, the plaintiffs resorted “to a policy argument unmoored to Article III.”

While they contend that, if standing is unavailable here, “the only way that any court could ever enjoin any agency from operating an insecure system to prevent it from being hacked would be if it had already been hacked, at which point an injunction would be pointless,” the court explained that “it is not the job of the federal courts to police the security of the information systems in the executive branch.”

Regarding their second theory of standing—the OPM computers that are connected to the GWES are vulnerable to hacking—Article III, the court stated, requires more than a possibility of future harm and the plaintiffs failed to show their.gov email addresses, which reveal their names and possibly places of employment, are at imminent risk of exposure outside the government, much less that this risk is a result of OPM’s failure to conduct an adequate PIA.

Earlier hack not enough. Though the plaintiffs pointed to a hack of the OPM databases that occurred about 10 years ago, they did not show that OPM computer systems that are connected to the GWES are at imminent risk of cyberattack and that this risk would be mitigated were the agency required to conduct a new and improved PIA.

Podcast. The plaintiffs also pointed to a podcast on which an anonymous “systems security expert” discussed potential vulnerabilities related to the GWES. But the podcast, said the court, did not provide any specific information from which the court could find that the servers housing.gov email addresses collected for purposes of the GWES are at imminent risk due to likely cyberattack. “To the contrary,” the court observed, “the anonymous expert mostly addresses a past vulnerability that has since been rectified.”

Noting further that the expert’s evidence was “mixed at best,” the court explained that “More is required to satisfy Article III, and more is required to demonstrate, as Plaintiffs must do to obtain emergency injunctive relief, that they are likely to succeed in establishing standing to sue.” Thus, the court found that, at this stage of the proceedings, the plaintiffs failed to show they face a concrete and impending risk that their.gov email addresses will be misappropriated in the absence of emergency injunctive relief.

Irreparable injury. Nor were they able to show they were likely to suffer an irreparable injury as the mere fact their.gov email addresses are stored on an allegedly unsecure IT system does not, standing alone, amount to such an injury. As already explained, said the court, they failed to show a significant risk that their.gov email addresses would be stolen or publicly disclosed in the next 14 days or that any such risk was a product of the inadequacies of OPM’s PIA.

Nor did they show that even if a massive hack were to occur due to OPM’s failure to prepare an adequate PIA, the disclosure of their.gov email addresses, along with millions of other.gov email addresses, would likely subject them to personal harassment or cause them a harm that is “certain” and “great.” Accordingly, the court denied their motion for a TRO.

The case is No. 25-234 (RDM).

Judge: Moss, R.

Attorneys: Kelly Brian McClanahan (National Security Counselors) for Jane Doe. Elizabeth J. Shapiro, U.S. Department of Justice, for Office of Personnel Management.

Cases: RemediesDamages Privacy PublicEmployees DistrictofColumbiaNews