Last Updated: October 25, 2026 Reading Time: 8 min

On October 20, 2026, a federal judge in New York ruled that OPM acted unlawfully when it gave Department of Government Efficiency agents broad access to its personnel systems. Those systems hold records on what the court called "tens of millions of past, current, and aspiring federal employees."

If you're one of them, the headlines can make it sound like a payout or a forced deletion is on the way. So far the ruling orders neither. Below is what it decided, what it left open, and what you can do on your own.

What the Court Decided

The case is American Federation of Government Employees v. OPM in the Southern District of New York. It was brought in 2025 by current and former federal employees and their unions.

In the October 20 opinion, the court wrote that the government's motion "is granted as to the plaintiffs' ultra vires claim but otherwise denied; the plaintiffs' cross motion for summary judgment on their APA claims is granted."

The APA claims rest on two Privacy Act requirements:

  • 5 U.S.C. § 552a(b), which generally bars an agency from disclosing your records without your written consent unless an exception applies
  • 5 U.S.C. § 552a(e)(10), which requires agencies to set up appropriate safeguards for the records they keep

The plaintiffs argued, and the court agreed, that opening OPM's systems to DOGE agents violated both, which made the decision "not in accordance with law" under the APA (5 U.S.C. § 706(2)(A)). The Privacy Act lets agency insiders see records only when they need them for their duties. The government argued DOGE agents qualified as OPM employees with that need, and the court rejected that defense.

This builds on an earlier stage of the case. A June 9, 2025 opinion found the plaintiffs entitled to a preliminary injunction, and the court later denied a motion to dismiss the case as moot.

Why This Ruling Doesn't Pay You

The plaintiffs started with two Privacy Act claims, the kind that can carry money damages. The court dismissed them in April 2025, "except insofar as they serve as a predicate to the plaintiffs' other claims." What survived were APA claims, and the APA covers only "relief other than money damages" (5 U.S.C. § 702).

So this case can produce court orders, such as a declaration or an injunction. It can't produce checks to employees.

What Happens Next: Relief Is Still Open

The plaintiffs asked for an order requiring DOGE agents "and any third party to delete or expunge such copies they possess" of OPM records. The court hasn't granted that yet.

Two points from the opinion matter here:

  • The access permissions have been rescinded. The court said "because all the access permissions have been rescinded, that access need not be vacated or set aside." It also noted that the changes since it last ruled the case was not moot "have been significant."
  • Relief gets decided separately. The court said it "will therefore solicit the parties' views on what relief, if any, is appropriate." Its October 20 order set November 6, 2026 for the parties to propose a schedule. That's a scheduling filing, not a ruling date.

Whether any order requires deleting copies of your data is the open question. Watch for the November 6 filing and the schedule that follows.

Can You Sue for Damages on Your Own?

In principle, the Privacy Act lets an individual sue for damages (5 U.S.C. § 552a(g)). In practice, the bar is high:

  • You must show the violation had an adverse effect on you personally.
  • The violation must be intentional or willful. If you prove that and actual damages, the law guarantees at least $1,000 plus attorney fees.
  • "Actual damages" means an out-of-pocket loss. The Supreme Court held in FAA v. Cooper (2012) that the Privacy Act doesn't cover mental or emotional distress. Worry about DOGE having your data isn't enough. A cost such as an identity-theft cleanup bill could be.
  • The filing deadline is two years from when the claim arises (§ 552a(g)(5)), or later if the agency materially and willfully misrepresented required information. For access that began in early 2025, the two-year point would generally fall in early 2027, depending on when your claim arose. Talk to a lawyer instead of assuming you have time.

The $1,000 is a floor for people who prove a loss, not a payment to everyone whose record was in the system.

How to Request Your Records From OPM

You generally have a right under the Privacy Act to see and copy the records OPM keeps about you, and to ask for its log of disclosures.

  1. Write a request that says it's made under the Privacy Act of 1974. Address it to the manager of the OPM system that holds your records. Include your full name, signature, home address and the other identifiers OPM's rules require (5 CFR part 297).
  2. Ask for the "accounting of disclosures" by name. It's a separate item from your records. Agencies must log disclosures outside the agency, and you can ask for that log (5 U.S.C. § 552a(c)).
  3. If you don't know which system holds a record, OPM's regulation lists a Privacy Act contact point (5 CFR 297.106).
  4. Don't expect a guaranteed turnaround. OPM's rules don't set a deadline for answering an access request. The 10-working-day acknowledgment in its rules covers requests to correct a record.

One caveat: because OPM treated DOGE agents as its own employees, their access may not show up in an accounting of outside disclosures.

For the personnel file itself, our guides to requesting your eOPF and reviewing your OPF walk through the forms.

What the Ruling Doesn't Say

  • It doesn't order breach notices or credit monitoring. We found nothing in the opinion that addresses either.
  • It doesn't decide criminal liability. The Privacy Act carries a criminal misdemeanor penalty for willful disclosure, but this is a civil decision and says nothing about it.
  • We found no class certification. The plaintiffs are named employees and their unions.

Frequently Asked Questions

What did the court decide on October 20, 2026?

Judge Denise Cote of the Southern District of New York granted the employees' and unions' motion for summary judgment on their Administrative Procedure Act claims, holding OPM's decision to give DOGE agents broad access to its systems of records unlawful. The government won only on the plaintiffs' separate ultra vires claim.

Will federal employees get money from this ruling?

No. The plaintiffs' Privacy Act claims, which can carry damages, were dismissed in April 2025. They won under the Administrative Procedure Act, which allows court orders but not money damages.

Did the court order DOGE to delete federal employee data?

Not yet. The plaintiffs asked for deletion of any copies, but the court said it will decide what relief, if any, is appropriate after hearing from both sides. The parties' proposed schedule is due November 6, 2026.

Can I sue OPM for damages myself?

You can try, but you'd need to prove an intentional or willful violation, an adverse effect on you, and a real out-of-pocket loss. Emotional distress doesn't count, and the Privacy Act's two-year filing deadline may already be running. Talk to a lawyer.

How do I find out whether my OPM records were disclosed?

Send OPM a written Privacy Act request for your records and its accounting of disclosures. Because OPM treated DOGE agents as its own employees, their access may not appear in that accounting.

Sources