Court Rules OPM Violated Privacy Act in Data Disclosure
A federal judge ruled that OPM improperly shared employee records with external agents starting in January 2025.
Updated on Oct. 20, 2026 in Cybersecurity
Live Poll
Do you trust the federal government to keep your personal employment records secure?
A federal court ruled that the Office of Personnel Management (OPM) violated the Privacy Act by granting unauthorized access to millions of federal employee records. The court issued this summary judgment on October 20, 2026, regarding data disclosures that began in January 2025.
Why it matters
The ruling underscores the legal limits of data sharing between federal agencies and external entities, highlighting the strict requirements set by the 1974 Privacy Act. It establishes a significant judicial check on how personally identifiable information is managed during administrative transitions.
The Office of Personnel Management violated two provisions of the 1974 Privacy Act, which regulates how federal agencies collect and disclose personal data. The court found that the agency improperly provided DOGE agents with access to internal systems containing sensitive personally identifiable information.
The players
Office of Personnel Management
The federal agency responsible for human resources management and maintaining records for federal employees.
DOGE agents
Personnel who were granted broad access to OPM systems and have since departed the government.
The details
The court found that OPM granted broad system access to DOGE agents, leading to the unauthorized disclosure of records. The Privacy Act of 1974 is a federal law designed to protect citizens from the misuse of personal data held by the government by limiting how that data can be shared. OPM has since rescinded database access for the agents, and the personnel involved have left the government.
Timeline
January 2025: OPM began disclosing personal data to DOGE agents.
October 20, 2026: Federal court issued summary judgment ruling.
The Tech Race
This ruling clarifies the legal boundaries governing how agencies integrate external personnel into government data architectures. It follows a pattern of heightened judicial scrutiny over how federal databases are secured against unauthorized access during organizational restructuring.
The immediate operational impact is the cessation of access for the involved agents and the rescinding of their database permissions. Affected federal employees must wait for the court to determine the specific remedy for the privacy violations.
The takeaway
The case highlights the enduring relevance of the Privacy Act in preventing unauthorized data exposure by agencies. Readers should monitor the federal docket for the upcoming decision on the court-ordered remedy for this violation.
Further reading
For more on the security protocols governing federal data, visit United States Cybersecurity.
Live Poll
Do you trust the federal government to keep your personal employment records secure?
