Judge: OPM unlawfully gave DOGE broad access to federal personnel data

The U.S. District Court issued a written opinion on Oct. 20 finding that the Office of Personnel Management (OPM) improperly granted broad access to systems containing sensitive records on tens of millions of federal workers to personnel from the Department of Government Efficiency (DOGE).

The court said OPM did not demonstrate that DOGE staff needed sweeping access to personally identifiable information to perform the modernization tasks they were assigned. The opinion warns that agencies cannot rely on program goals alone to justify unfettered access to confidential data.

“IT modernization does not necessarily require access to confidential PII,” U.S. District Judge Denise Cote wrote.

What the court found

The opinion describes specific access and internal steps taken at OPM:

• 20 DOGE-related individuals accessed OPM systems between Jan. 20 and Mar. 6, 2025.
• Almost all of that access was at the administrative level, which can allow broad visibility and control over records.
• Internal OPM emails showed the agency’s Office of the Chief Information Officer temporarily revoked access for career database administrators while DOGE access remained in place.

The contested systems held personnel, employment and other identifying information for past, current and prospective federal employees. The court record also indicates that career OPM staff extracted names and government email addresses from agency systems for a government-wide email service and that career employees may have pulled data for a retirement services modernization effort. Those practices underscore the variety of ways data can be shared within and beyond an agency.

Government argument and the court’s response

The government argued DOGE personnel needed broad access because President Donald Trump’s executive orders assigned DOGE modernization responsibilities. The court rejected that justification, saying the record did not support the contention that sweeping access to confidential data was necessary to carry out IT modernization.

Former OPM Chief Information Officer Gregory Hogan provided testimony in the case; the opinion cites his statements about access that OPM granted in anticipation of DOGE personnel migrating systems.

Broader implications

The opinion reaches beyond the immediate dispute, noting potential consequences as federal agencies deploy newer technologies. The ruling highlights risk points as agencies increasingly use AI, data lakes, common application programming interfaces (APIs), and identity-resolution systems that connect information previously siloed in separate environments. Those architectures can expand who can see or combine personal data unless agencies restrict privileged access and document need.

Privacy advocates and agency officials will likely watch the case for guidance on how to balance IT modernization with statutory and constitutional privacy protections. The decision signals that courts will scrutinize claims that technical projects automatically require access to comprehensive personal data.

The court’s written opinion was issued by U.S. District Judge Denise Cote. It does not resolve every factual dispute alleged by the parties; the opinion focuses on whether the government demonstrated a lawful need for the breadth of access OPM provided to DOGE personnel.