In a landmark decision for data privacy, a federal court in New York has definitively ruled that the **Office of Personnel Management (OPM)** violated federal law by disclosing millions of federal employee records to agents of the **U.S. DOGE Service**. The summary judgment, issued on October 20, 2026, found **OPM** in breach of two critical provisions of the Privacy Act of 1974. ### Unlawful Disclosure and Security Failures The court determined that **OPM** violated both the provision restricting the disclosure of personal records between agencies and the requirement for agencies to protect the security and confidentiality of such records. Judge **Denise Cote** highlighted the unlawful nature of **OPM**'s decision to grant **DOGE Agents** broad access to systems containing Personally Identifiable Information (PII). “By virtue of the Court’s summary judgment ruling, **OPM**’s decision to grant **DOGE Agents** broad access to its systems of recordings containing [personally identifiable information (PII)] has been held unlawful,” Judge **Cote** wrote. She further noted, “The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted **OPM** to grant sweeping and expedited access to a score of **DOGE Agents** to its systems of records containing PII.” ### The Scope of the Breach Starting in January 2025, **OPM**, which maintains highly sensitive personal information for tens of millions of federal employees, retirees, and job applicants, began disclosing this data to the **U.S. DOGE Service**, initially led by **Elon Musk**. This disclosure directly contravenes the federal Privacy Act of 1974, a pivotal anti-surveillance statute designed to prevent government misuse of personal information. ### Legal Action and Future Remedies The lawsuit against **OPM** and **DOGE** was filed by the **Electronic Frontier Foundation (EFF)**, representing unions of federal employees, including the **American Federation of Government Employees** and the **Association of Administrative Law Judges**, as well as individual employees. The **EFF**, with co-counsel from **Lex Lumina LLP**, **State Democracy Defenders Fund**, and **The Chandra Law Firm LLC**, sought injunctive and declaratory relief in the U.S. District Court for the Southern District of New York. While many **DOGE Agents** have since left government service and **OPM** has rescinded their database access, the court's ruling underscores the need for **OPM** to address the cybersecurity vulnerabilities it created. The court will determine the specific remedies at a later date, which could include measures to enhance data security and prevent future breaches.