EFF Sues OPM Over Musk, DOGE Access to Sensitive Information

EFF's lawsuit followed an Electronic Privacy Information Center's suit against the OPM, DOGE and Musk a day earlier (see 2502110056). “Because these violations have been happening so fast, we didn't coordinate,” EFF Staff Attorney Mario Trujillo told us Wednesday. “But it is heartening to see so much good work being done.”

EFF's complaint says, “The Privacy Act makes it unlawful for OPM Defendants to hand over access to OPM’s millions of personnel records to DOGE Defendants, who lack a lawful and legitimate need for such access.” It continues, “No exception to the Privacy Act covers DOGE Defendants’ access to records held by OPM. OPM Defendants’ action granting DOGE Defendants full, continuing, and ongoing access to OPM’s systems and files for an unspecified period means that tens of millions of federal-government employees, retirees, contractors, job applicants, and impacted family members and other third parties have no assurance that their information will receive the protection that federal law affords.”

Filed in the U.S. District Court for Southern New York, the complaint was made on behalf of two labor unions as well as current and former individual government workers across the country, EFF said. In addition to asking the deferral court to stop OPM from disclosing Americans’ sensitive information to Musk and DOGE, it requests that any data OPM already disclosed to DOGE be deleted.

“Concerns about unauthorized parties seeking access to OPM data are exacerbated by the facts that DOGE agents have not received security clearance through a normal process, and that at least one of those agents has previously been fired from private employment in connection with disclosure of his employer’s secrets (which means he would not have passed a normal security-clearance vetting),” the complaint said. “The Privacy Act strictly protects personal information from improper disclosure and misuse, including by barring disclosure to other agencies within the federal government and individuals who lack a lawful and legitimate need for it. OPM Defendants are not permitted to give access to that information to other persons or agencies unless granting that access fits within one of the Privacy Act’s enumerated exceptions.”

The EFF and EPIC lawsuits are complementary, as they represent different plaintiffs in a different jurisdiction, said Trujillo. “We should be fighting for everyone in every place where they are being harmed,” he said. “There are some unique claims as well. We both sued under the Privacy Act's prohibition on disclosure. But EFF has also sued for OPM and DOGE failing to maintain security under the Privacy Act, while EPIC brings a unique claim about OPM creating an illegal matching program under the Privacy Act.”

On Wednesday, EPIC filed a motion for a temporary restraining order enjoining the OPM and Treasury from allowing unauthorized or unlawful access into their information systems. "DOGE personnel have sought and obtained unprecedented access to information systems across numerous federal agencies," the motion said, and are "running roughshod over core data protections and endangering the security of vital government systems."

In addition to the suits from EFF and EPIC, a coalition of Democratic attorneys general have sued (see 2502070050), as well as the University of California Student Association (see 2502100074) and a federal employee union (see 2502100068). Consumer advocates predict a continued legal clampdown on the issue (see 2502100060).

In a press briefing Wednesday afternoon, press secretary Karoline Leavitt addressed the growing amount of litigation over DOGE access. "Many outlets in this room have been fearmongering the American people into believing there is a constitutional crisis taking place here at the White House," she said. "The real constitutional crisis is taking place within our judicial branch, where district court judges and liberal districts across the country are abusing their power to unilaterally block President Trump's basic executive authority."

Leavitt said that each injunction "is an abuse of the rule of law" and an "attempt to thwart the will of the people" who elected Trump president. "This is part of a larger concerted effort by Democrat activists and nothing more than the continuation of the weaponization of justice against President Trump," she said. "As the President clearly stated in the oval office yesterday, we will comply with the law in the courts, but we will also continue to seek every legal remedy to ultimately overturn these radical injunctions and ensure President Trump's policies can be enacted."