Labor & Employment Law Daily Wrap Up, REMEDIES, DAMAGES—D. Md.: Education, OPM, Treasury preliminary enjoined from disclosing PPI to DOGE affiliates, (Mar 25, 2025)

By Kathleen Kapusta, J.D.

“No matter how important or urgent the President’s DOGE agenda may be, federal agencies must execute it in accordance with the law.”

Granting a preliminary injunction requested by several unions and individual plaintiffs, who sued the government alleging that the departments of Education, Treasury, and OPM unlawfully granted access to records containing their PPI to DOGE representatives, a federal court in Maryland found they have shown a likelihood they will succeed on their claim the defendants violated the APA by not acting in accordance with the Privacy Act. Further, said the court, the ongoing disclosure of their PPI to government employees not authorized to access it constitutes irreparable harm, which will continue without a preliminary injunction. The court limited the preliminary injunctive relief to the disclosure of PPI of the individual plaintiffs and the organizational plaintiffs’ members (American Federation of Teachers v. Bessent, No. DLB-25-0430 (D. Md. Mar. 24, 2025)).

On January 20, 2025, President Trump signed the Executive Order that established the Department of Government Efficiency (DOGE) and tasked it with implementing “the President’s DOGE Agenda, by modernizing Federal technology and software to maximize governmental efficiency and productivity.” The EO also renamed the United States Digital Service as the United States DOGE Service (USDS), and commanded federal agency heads to “take all necessary steps... to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.”

Access to PII. Almost immediately, federal agencies, including Education, OPM, and Treasury, hired or accepted individuals detailed to implement the DOGE Executive Order. Education, OPM, and Treasury gave these individuals access to agency systems that hold records with the personally identifiable information (PII) of millions of Americans.

Contending that the “continued and ongoing disclosure of their records to DOGE representatives constitutes a violation of the Privacy Act, for which no exception applies,” the plaintiffs—several unions that represent teachers, healthcare professionals, retired federal employees, veterans, and veterans groups, and numerous federal employees, among others, as well as six individualssued the government. Because the members of the organizational plaintiffs and the individual plaintiffs have worked for the federal government, have federal student loans, and/or receive government benefits, their PII is housed in record systems maintained by Education, OPM, and/or Treasury.

APA violations. The plaintiffs assert three violations of the APA, including that the agencies’ actions violated the Privacy Act and that the agencies did not act in accordance with law; the agencies acted arbitrarily and capriciously when they failed to consider the requirements of the Privacy Act and failed to engage in reasoned decision-making when they granted DOGE representatives broad access to their record systems containing sensitive and personal information; and that the agencies violated non-discretionary duties to protect records from unauthorized disclosure.

TRO. On February 24, the court granted in part and denied in part their motion for a TRO, enjoining Education and OPM from disclosing the plaintiffs’ PII to DOGE affiliates until March 10. The plaintiffs subsequently moved for a preliminary injunction.

Standing. Addressing first the issue of standing, the court found that the ongoing unlawful access to the plaintiffs’ sensitive personal information by DOGE affiliates who are not authorized to access it is a concrete injury in fact. Thus, the plaintiffs demonstrated that they have standing.

Final agency action. Noting next that the APA allows for judicial review of “final agency action for which there is no other adequate remedy in court,” the court found that “the agencies’ decisions to grant DOGE affiliates access to records with the PII of millions of Americans impacts the privacy rights of the people whose PII is housed within these systems.” Further, these were not only agency actionsthey were final agency actions. The decisions were neither tentative nor interlocutory in nature and there was nothing more for the agencies to do to formalize the decisions. “The agency actions,” said the court, “marked the consummation of the agency’s decisionmaking process.”

Rejecting the government’s contention that the agencies’ decisions had no “actual legal effect,” the court pointed out that the agencies determined that disclosure of the plaintiffs’ PII did not require the plaintiffs’ consent and that such disclosure fell within one of the Privacy Act’s exceptions. “Thus,” said the court, “the decisions of Education, OPM, and Treasury had a legal effect: They determined the plaintiffs’ rights and the agencies’ obligations under the Privacy Act.”

Preliminary injunction. Turning to whether, for purposes of the preliminary injunction, the plaintiffs established that they were likely to succeed on the merits of their APA claim, the court noted that they asserted that the agencies did not act in accordance with the Privacy Act when they disclosed agency records containing their PPI to DOGE affiliates. Here, the court found the plaintiffs have shown a likelihood of success on the merits of their APA claim that Education, OPM, and Treasury took final agency actions “not in accordance with law.”

The government argued that the disclosures complied with the Privacy Act because, under the statute, the agencies did not need to obtain the plaintiffs’ consent. Under the general rule, however, disclosure of agency records requires consent. Under an exception to this general rule, the Privacy Act provides that disclosure is permitted “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” To fall within this exception, the court observed, the disclosure must be within the agency that maintains the record.

Need to know. Though the government relies on the need-to-know exception to defend the disclosure of entire systems of records to DOGE affiliates at Education, OPM, and Treasury, this exception applies only to intra-agency disclosure, the court stated. Even assuming, without deciding, that the DOGE affiliates are employees of the agencies that granted them access to systems of records, the court explained that the Privacy Act’s need-to-know exception applies when there is a valid explanation for why the employee needed access to the protected information to perform their job duties. And here, said the court, the administrative records do not explain why the DOGE affiliates at Education, OPM, and Treasury need access to the plaintiffs’ PII to do their jobs.

Specifically, said the court, the “DOGE Executive Order does not explain why DOGE affiliates at Education (or any agency for that matter) need access to ‘all unclassified IT systems and data’ to modernize technology and software.” While DOGE affiliates may need some form of system access to modernize technology and software, that did not mean that they need access to all of the records containing PII housed in those systems, the court reasoned.

Waste, fraud, abuse. As to the government’s contention that “[a]ll six [DOGE affiliates] work to audit contract, grant and related programs for waste, fraud and abuse” and that they need access to records “in order to audit student loan programs for waste, fraud, and abuse,” the court found this rationale appeared “to be created out of whole cloth” as the DOGE EO does not mention waste, fraud, and abuse or auditing student loan programs. Thus, said the court, the administrative record did not explain why the DOGE affiliates at Education need access to all of Education’s unclassified systems and datawhich include the plaintiffs’ PIIin the performance of their job duties.

Modernize technology. Nor was there anything in the administrative record to explain why DOGE affiliates at OPM need to know the PII in OPM’s systems of records in the performance of their job duties. The government pointed to the EO’s directive to modernize technology but did not cite any record evidence to explain why a directive to modernize technology requires access to the extensive PII housed within OPM’s systems. As a result, the court found OPM likely disclosed records with the plaintiffs’ PII to DOGE affiliates who did not have a need to know the information in the performance of their duties.

Similarly, the court found nothing in the administrative record to show that DOGE affiliates at Treasury need access to the PII in the agency’s payment record systems to modernize technology at the agency. Thus, the plaintiffs established a likelihood of success on the merits of their APA claim that Education, OPM, and Treasury acted “not in accordance with law.”

Irreparable harm. The court next found that the plaintiffs established that they were likely to suffer actual and imminent harm without injunctive relief. There was evidence DOGE affiliates have been granted access to systems of records that contain some of the plaintiffs’ most sensitive datasuch as Social Security numbers, dates of birth, home addresses, bank information, income and assets, and citizenship status. Further, without an injunction, the DOGE affiliates’ access to this personal information will continue, said the court, noting the government’s position that the DOGE affiliates’ access to records containing the plaintiffs’ PII is not only lawful, but also that it is necessary for them to do their jobs.

The plaintiffs also established that the ongoing disclosure of their PII to government employees not authorized to access it constitutes irreparable harm. “This ongoing violation of the plaintiffs’ privacy interests,” the court continued, “cannot be redressed by a final judgment of money damages or by permanent injunctive relief.”

Balance of equities and public interest. As to the balance of equities and public interest, the court found that preventing the government’s unauthorized disclosure of the plaintiffs’ sensitive personal information is in the public interest. While the government argued that preliminary injunctive relief would harm the public interest because it would “limit[] the President’s ability to effectuate the policy choices the American people elected him to pursue by limiting his advisors and other employees’ ability to access information necessary to inform that policy,” the court disagreed. A preliminary injunction, it explained “does not prevent the President from effectuating the administration’s policies. It prevents the likely unlawful disclosure of the plaintiffs’ sensitive personal information to DOGE affiliates who, on the record before the Court, do not have a need to know the information to perform their duties.”

Scope of injunction. Regarding the scope of the injunction, because the injury here is the unauthorized disclosure of the plaintiffs’ PII to DOGE affiliates at Education, OPM, and Treasury, the court limited the preliminary injunctive relief to the disclosure of the PII of the individual plaintiffs and the organizational plaintiffs’ members.

The case is No. DLB-25-0430.

Judge: Boardman, D.

Attorneys: David J. Rodwin (Murphy Anderson) for American Federation of Teachers. Bradley Philip Humphreys, U.S. Department of Justice, for Scott Bessent.

Companies: American Federation of Teachers

Cases: RemediesDamages PublicEmployees Privacy Procedure DOGE FedTracker MarylandNews