Labor & Employment Law Daily Wrap Up, REMEDIES, DAMAGES—S.D.N.Y.: Federal employees entitled to injunctive relief against OPM’s records disclosures, (Jun 10, 2025)

By Kathleen Kapusta, J.D.

The U.S. Office of Personnel Management maintains systems of records that contain the personal information of tens of millions of Americans, including past, current, and aspiring federal employees.

Granting a preliminary injunction as to some of the relief requested by current and former government employees and unions representing government employees—who alleged that data contained in OPM databases, including the employees’ personally identifiable information, was improperly disclosed to DOGE agents—a federal court in New York found they showed a likelihood of success on the merits of their APA claims as they demonstrated that two violations of the Privacy Act occurred and that the APA provides for judicial review of the defendants’ actions. They failed, however, to show a likelihood of success on the merits of their ultra vires claim, which pertains solely to the DOGE defendants, as the APA already gives them meaningful relief for the violation of their rights (American Federation of Government Employees, AFL-CIO v. U.S. Office of Personnel Management, No. 25cv1237 (DLC) (S.D.N.Y. Jun. 9, 2025)).

When President Trump, on January 20, signed Executive Order 14158, which established the Department of Government Efficiency (DOGE) to implement his DOGE agenda “by modernizing Federal technology and software to maximize governmental efficiency and productivity,” each executive agency was instructed to establish a DOGE team and agencies were instructed to ensure, “to the maximum extent consistent with law,” that DOGE has “full and prompt access to all unclassified agency records, software systems, and IT systems.”

Alleging that OPM gave at least six DOGE agents immediate access to all OPM personnel systems, including systems that maintain personal and employment information of tens of millions of current and former federal employees, contractors, and job applicants, the plaintiffs sued OPM and DOGE under the Privacy Act and the Administrative Procedure Act. They claimed that at the time DOGE agents were given access to these systems, they had not been properly vetted, had not received customary security clearances, and had not received OPM’s security training. They also described harms they fear they may suffer from the disclosure of OPM records to the DOGE agents, including an increased vulnerability of their personal data to cyberattacks, hacking, and identity theft.

Prior decision. They sought a TRO but subsequently joined the defendants who had requested the motion be converted into one for a preliminary injunction. The defendants then moved to dismiss the complaint, which the court granted in part, finding that the plaintiffs could not obtain declaratory or injunctive relief for the Privacy Act claims they alleged but could seek that relief through the APA. It also found that they adequately pled their APA claims.

Standing. Addressing, for purposes of the preliminary injunction motion, the plaintiffs’ Article III standing, the court found they demonstrated a concrete injury analogous to intrusion upon seclusion. The records allegedly accessed by DOGE include social security numbers, health care information, banking information, and information about family members. OPM records, the court observed, can also be used to reveal intelligence connections regarding federal employees in sensitive undercover roles or to find federal employees who may be subject to threats of retaliation. The plaintiffs demonstrated that, beginning on January 20, OPM gave access to records containing PII to 17 DOGE agents, as well as to three individuals in OPM leadership positions.

They have also shown that, in doing so, OPM violated the Privacy Act and the APA, including because the DOGE agents did not have a sufficient need for the access they were given and because OPM disregarded its cybersecurity standards.

Further, said the court, despite being responsible for safekeeping the plaintiffs’ records, the OPM defendants disclosed them to multiple government employees without requiring them to be adequately vetted or trained and without limiting their access as required by law and OPM’s procedures. This harm, said the court, is redressable through an injunction that can prohibit improper disclosure from continuing and require the destruction of any OPM records that have been improperly copied.

Likelihood of success on the merits. Turning to the plaintiffs’ likelihood of success on the merits of their APA claims, the court explained that the Privacy Act restricts the disclosure of individuals’ private data without their permission, subject to specific exceptions, including as relevant here, disclosure “to those officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” Not only is OPM one of the agencies to which the Privacy Act applies, said the court, providing access to another person for their review of the record is a disclosure, even if the access is not used.

Finding that the plaintiffs have shown a likelihood of proving a violation of the Act’s prohibition of the disclosure of certain records, the court noted that OPM maintains numerous systems that contain records pertaining to the plaintiffs and that the plaintiffs did not consent to the disclosure of those records to the defendants in the ways at issue here. Specifically, the plaintiffs have shown a likelihood of proving at trial that those OPM records were disclosed to individuals affiliated with DOGE who were not OPM employees or did not have a need for the records in the performance of their duties at OPM.

While OPM argued that the plaintiffs did not show that the four individuals to whom the records were disclosed were not OPM employees, the court found that they were likely to prove that at least one of the individuals, who was appointed to a 180-day term, was not an OPM employee. That individual was also detailed to three other agencies and appointed to the SSA. And if he was not an OPM employee, the court explained, disclosure of OPM records to him violated the Privacy Act regardless of whether he needed that access to perform any duties that were assigned to him, whether by OPM or another agency.

Need to review. As to the defendants’ assertion the plaintiffs have been unable to show the relevant individuals did not have a need for access to the OPM systems in the performance of their duties, the court found “clear evidence that the DOGE agents did not need access to the records disclosed to them, much less the administrative access that they were given.” Indeed, the court observed, when the Acting OPM Director requested access for three individuals on January 27, he admitted there was no need to access the records at that time. He also stated that when access was granted to DOGE agents, “the intention” was that they “may have a need to use those permissions.”

Lack of appropriate safeguards. Addressing the plaintiffs’ second Privacy Act claim—the defendants violated a duty to safeguard their records—the court noted evidence the defendants ignored many of OPM’s safeguards in connection with the employees brought into OPM to pursue the DOGE agenda. Further, said the court, DOGE engineers and other DOGE agents were almost uniformly given administrative, or maximum, access without any need for that access. While the defendants argued only that OPM followed its established procedures for vetting and background checks, the court found that “on this point, the record described above indicates otherwise.”

APA claims. Because the plaintiffs have shown a likelihood of success in proving violations of the Privacy Act, the court found they were likely to prove that the defendants’ actions were “not in accordance with law” pursuant to the APA. The plaintiffs have also shown that the OPM defendants violated the APA by acting in an arbitrary and capricious manner, said the court, noting that “OPM’s decision to give DOGE agents administrative access to multiple OPM systems containing PII was a gross departure from its obligations under the Privacy Act as well as its longstanding cybersecurity practices.”

Not only did it rush its onboarding process—and even provide access to many DOGE individuals before they completed training—the wide-ranging administrative access provided to DOGE agents who did not have any credible need for access violated OPM standards.

Final agency action. Moreover, the court found the plaintiffs have shown that OPM engaged in a final agency action when it gave access to sensitive and legally protected records in violation of federal statutes, its own cybersecurity practices, and even the DOGE Executive Order. “The decision to give access to DOGE agents was the ‘consummation’ of OPM’s decision-making process; it was neither tentative nor interlocutory,” said the court, and it was a decision from which legal consequences flow.

Ultra vires claim. Finally, as to the plaintiffs’ ultra vires claim against the DOGE defendants, the court noted that the plaintiffs have shown a likelihood of success under the APA and may obtain relief through an injunction targeted exclusively at the OPM defendants. Here, the court found that “relief pursuant to the ultra vires claim is inappropriate because the APA already gives the plaintiffs meaningful relief for the violation of their rights.”

Remaining injunction factors. Addressing the remaining injunction factors, the court found the plaintiffs have shown irreparable harm due to both the unlawful disclosure of OPM records to employees working on the DOGE agenda and the increased risk to cybersecurity because of the unlawful disclosure. Moreover, said the court, lax cybersecurity it an ongoing risk that can lead to public disclosure.

As to public interest, the court found noted that the plaintiffs have shown that in disclosing OPM records to individuals who had no legal right of access to those records, the defendants violated the Privacy Act and departed from cybersecurity standards that they are obligated to follow, which was “a breach of law and of trust.”

Accordingly, the court granted the plaintiffs’ motion for a preliminary injunction, noting that its scope would be address in a separate order.

The case is No. 25cv1237 (DLC).

Judge: Cote, D.

Attorneys: Mario Trujillo, Electronic Frontier Foundation, Rhett O. Millsaps II (Lex Lumina), Andrew H. Warren (State Democracy Defenders Fund), and Subodh Chandra (The Chandra Law Firm) for American Federation of Government Employees, Association of Administrative Law Judges, and International Federation of Professional and Technical Engineers Judicial Council 1. Jeffrey Oestericher for United States Attorney’s Office, Southern District of New York.

Companies: American Federation of Government Employees, AFL-CIO; Association of Administrative Law Judges; International Federation of Professional and Technical Engineers Judicial Council 1

MainStory: TopStory RemediesDamages PublicEmployees Privacy LaborEmployment FedTracker DOGE NewYorkNews GCNNews