On October 20, 2026, U.S. District Judge Denise Cote of the Southern District of New York granted summary judgment to federal employee unions in AFGE v. OPM, ruling that the Office of Personnel Management violated the Privacy Act when it gave Department of Government Efficiency staff access to its personnel systems. “In doing so, OPM violated the law and bypassed its established cybersecurity practices,” she wrote, adding, “The defendants barely defend its legality, relying instead on what has happened since.” The government won on a separate claim that the access was beyond its authority altogether.
The court noted that “no DOGE Agent has had access to OPM systems containing PII since September 2025,” and no remedy has been ordered yet; the parties' proposals are due November 6. A separate challenge to DOGE's access to OPM and Treasury data is proceeding in Virginia (see A Judge Lets a Privacy Lawsuit Over DOGE's Access to Treasury and OPM Data Proceed).