Judge Cote Finds OPM Violated Two Privacy Act Provisions by Opening Its Records to DOGE (AFGE v. OPM, S.D.N.Y.)

Judge Denise Cote of the Southern District of New York granted a preliminary injunction in AFGE v. OPM on the date the opinion was filed. The court held that the plaintiffs had shown a likelihood of success and that there were “two violations of the Privacy Act”: the disclosure bar and the duty to keep appropriate safeguards, “5 U.S.C. § 552a(e)(10)”. In the opinion’s closing section the court wrote that OPM gave records to “individuals who had no legal right of access to those records”, which violated the Privacy Act and departed from the cybersecurity standards OPM must follow.

Strength of finding. This is a court finding at the preliminary-injunction stage, not a final judgment. In a later order the court recorded the government’s own reference to “OPM’s election not to appeal this Court’s preliminary injunction decision”, alongside the government’s position that OPM does not concede the prior access was unlawful. No appellate court has stayed or reversed this finding on the documents read for this entry.

Why it matters for the privacy-rules ledger. Of the DOGE data-access rulings, this is the Privacy Act finding that was not appealed. The parallel Maryland rulings on SSA and on Treasury, Education and OPM were stayed and then vacated on appeal; see 2026-04-10–fourth-circuit-en-banc-vacates-afscme-v-ssa-injunction-irreparable-harm-only.