WASHINGTON, D.C. (FEDweek) — The OPM “violated the law and bypassed its established cybersecurity practices” by giving representatives of DOGE “broad access to systems of records containing the personal information of tens of millions of past, current, and aspiring federal employees, even though no credible need for this access had been demonstrated,” a federal judge has ruled.
District Judge Denise Cote of the U.S. District Court for the Southern District of New York granted final judgment in favor of the AFGE union, individual employees and others who brought the case, although she left for later what type of remedy she will order.
The court last year had issued a preliminary injunction, holding that they were likely to prevail in their claims that OPM had violated the Privacy Act by disclosing to individuals affiliated with DOGE who were not OPM employees or did not have a need for the records in the performance of their duties at OPM; and that OPM had “set aside its established safeguards in connection with individuals brought into OPM to pursue the DOGE agenda.”
Following numerous legal motions and reports to the court since then, Judge Cote has now issued a judgment of a Privacy Act violation. The decision said that OPM “ignored many of its privacy and cybersecurity safeguards in connection with DOGE Agents”–for example by not assuring that they had completed required privacy training—and “also violated core cybersecurity principles that it purports to follow, such as the principle of least privilege.”
Since the preliminary injunction issued, OPM reduced access privileges and put in new privacy and security protocols, saying those actions made the case moot. However, the judge wrote that it is “no more difficult for OPM to ignore these new protocols than to ignore its old procedures.”
“The misconduct at issue in this litigation was not attributable to deficient procedures or a lack of clarity regarding the law. Rather, it resulted from the failure of particular individuals to abide by the Privacy Act and to honor the safeguards already in place at OPM. The effectiveness of any law and such government safeguards ultimately depends on the fidelity of those entrusted to observe and enforce them, and even the most rigorous procedures cannot secure compliance by those willing to disregard them,” she wrote.
The judge noted that she had earlier rejected OPM’s argument that the access was granted for the DOGE mission to modernize agency IT, saying that “IT modernization does not necessarily require access” to personally identifiable information, “much less administrative access.”
“The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII,” the new decision added.
As to what remedy might be available to those affected – “The primary route for federal employees to pursue misuse of their personal information is through the Privacy Act of 1974, which protects against unlawful use or disclosure or personally identifiable information,” noted attorney Michael Fallings with Tully Rinckey PLLC. “Federal employees may pursue these claims by filing with the Office of Inspector General (OIG) or a privacy act officer of their agency. Employees could obtain damages for privacy action violations.”
