The Office of Personnel Management breached federal law by giving the Elon Musk-led Department of Government Efficiency access to sensitive government data, a federal judge has ruled.
In a 39-page decision, Judge Denise Cote found that OPM violated the Privacy Act of 1974, which restricts the disclosure of certain records and sets requirements for protecting personal information. She also said the agency failed to follow its own cybersecurity practices.
The data included personally identifiable information relating to tens of millions of federal employees, job applicants and retirees. Judge Cote said the government had not provided a credible explanation for why DOGE needed access to it.
“The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary,” she wrote.
The Department of Justice, acting for OPM, had argued that DOGE representatives needed access to employee records, background checks, medical files and banking information as part of efforts to modernise the federal workforce.
Judge Cote rejected that justification, saying previous government modernisation programmes had not required access to such information. She also found that the administration had failed to establish a link between the data access and DOGE’s responsibilities.
DOGE was assembled by Mr Musk during the opening days of President Donald Trump’s second term, with the stated aim of reducing waste, fraud and abuse across the federal government.
The organisation has claimed savings of 215 billion dollars (£160 billion) through cancelled contracts and reductions involving about 300,000 government workers. Former federal employees, including former acting IRS commissioner Douglas O’Donnell, have warned that the cuts could have lasting effects on the government’s ability to improve efficiency through updated technology.
DOGE access to sensitive government data
Judge Cote also dismissed the government’s argument that the legal challenge was no longer relevant because DOGE was no longer a centralised entity.
She said DOGE representatives had accessed sensitive OPM data since September 2025 and that at least one former DOGE agent was no longer employed by OPM. The judge did not set out a final remedy in the case.
A coalition of unions, including the AFL-CIO, brought a separate legal challenge against DOGE and the Department of Labor in February 2025 over access to private information.
Mr Musk previously defended the access, arguing that government databases needed to be reconciled because they did not communicate with one another. He said that disconnect was a major vulnerability for fraud and described the work as difficult but necessary to improve the efficiency of government systems.
Policy experts have warned that DOGE’s access could create cybersecurity and privacy risks, including the possibility of private-sector engineers without security clearances handling sensitive information on personal devices.
They have also raised concerns about the risks of bringing large amounts of personal information together in a centralised database, which could become more vulnerable to hackers.
