These days, it's more of a second-row seat - I work remotely, mostly on my own projects, and I rely on our Deeplinks blog as much as our internal message-boards to keep up with our cases. Yesterday, I happened on this fantastic explainer breaking down our most recent court victory, in our case against DOGE on behalf of federal workers whose privacy rights have been violated during DOGE's raid on the Office of Personnel Management's databases:

eff.org/deeplinks/2025/04/our-…

3/

Our Privacy Act Lawsuit Against DOGE and OPM: Why a Judge Let It Move Forward

Last week, a federal judge rejected the government’s motion to dismiss our Privacy Act lawsuit against the U.S. Office of Personnel Management (OPM) and Elon Musk’s “Department of Government Efficiency” (DOGE).

^{Electronic Frontier Foundation}

The post is by Adam Schwartz, EFF's Privacy Litigation Director. I've been campaigning on privacy for my entire adult life, but I still learn something - something big and important - every time I talk about the subject with Adam. His breakdown on EFF's latest court victory is no exception.

4/

EFF was the first firm to bring a suit directly against DOGE, representing two federal workers' unions: the AFGE and the AALJ, and our co-counsel are from Lex Lumina LLP, State Democracy Defenders Fund, and The Chandra Law Firm. At the heart of our case are the millions of personnel records that DOGE agents were given access to by OPM Acting Director Charles Ezell.

5/

The OPM is like the US government's HR department. It holds files on every federal employee and retiree, filled with sensitive, private data about that worker's finances, health, and personal life. The OPM also holds background check data on federal workers, including the deep background checks that federal workers must undergo to attain security clearances.

6/

Many of us - including me - first became familiar with the OPM in 2015, after its records were breached by hackers believed to be working for the Chinese military:

en.wikipedia.org/wiki/Office_o…

That breach was catastrophic. Chinese spies stole the sensitive data of tens of millions of Americans. The DOGE breach implicates even *more* Americans' private data, though.

7/

Sure, DOGE isn't a foreign intelligence agency, but that cuts both ways. It's a good bet that a Chinese spy agency will not leak the records it stole, but with DOGE, it's another matter entirely. I wouldn't be surprised to find the OPM data sitting on a darknet server in a month or a year.

In his breakdown, Adam explains the ruling and what was at stake.

8/

We brought the case on behalf of all those federal workers under the 1974 Privacy Act, which was passed in the wake of Watergate and the revelations about COINTELPRO, scandals that rocked the nation's faith in federal institutions. The Privacy Act was supposed to restore trust in government, and to guard against future Nixonian enemies lists:

tile.loc.gov/storage-services/…

9/

The Privacy Act's preamble asserts that the US government's creation of databases on Americans - including federal workers - "greatly magnified the harm to individual privacy." This is the basis for the Act's tight regulation on how government agencies use and handle databases containing dossiers on the lives of everyday Americans.

The US government tried to get the case tossed out by challenging our clients' "standing" to sue.

10/

Only people who have been harmed by someone else has the right ("standing") to sue over it. Does having your data leaked to DOGE constitute a real injury? Two recent Supreme Court cases say it does: *Spokeo vs Robins* and *Transunion vs Ramirez* both establish that "intangible" injuries (like a privacy breach) can be the basis for standing.

11/

The court agreed that our clients had standing because the harms we alleged - DOGE's privacy breaches - are "concrete harms analogous to intrusion upon seclusion" ("intrusion upon seclusion" is one of the canonical privacy violations, set out in the Restatement of Torts, the American Law Institute's comprehensive guide to common law).

12/

But the court went further, noting that DOGE's operation is accused of being "rushed and insecure," rejecting DOGE's argument that it only accessed OPM's "system" but not the data stored *in* that system. The court also said that it wouldn't matter if DOGE access the system, but not the data - that merely *gaining access* to the data violated our clients' privacy.

13/

Here, the judge is part of an emerging consensus, joining with four other federal judges who've ruled that when DOGE gains access to a system containing private data, that alone constitutes a privacy violation, even if DOGE doesn't look at or process the records in the system.

14/

So in ruling for our clients, the judge found that the mere fact that DOGE could access their records was an injury that gave us standing to proceed - and also found that there were other injuries that would separately give us standing, including the possibility that DOGE's breach could expose our clients to "hacking, identity theft, and other activities that are substantially harmful."

15/

The US government repeatedly argued that we weren't accusing them of disclosing our clients' records, every time they did this, the judge pointed to our actual filings, which plainly assert that DOGE agents were "viewing, possessing and using" our clients' records, and that this constitutes "disclosure" under the law, and according to OPM's own procedures.

16/

The judge found that we were entitled to seek relief under the Administrative Procedures Act (APA), which proscribes the conduct of federal agencies - and that our relief could be both "declaratory" (meaning a court could rule that DOGE was breaking the law) and "injunctive" (meaning the court could order DOGE to knock it off).

Normally, a plaintiff can't ask for a judgment under the APA until an agency has taken a "final" action.

17/

The court found that because DOGE's actions were accused of being "illegal, rushed, and dangerous," and that this meant that we could seek relief under the APA. Further, that we could invoke the APA here because the remedies set out in the Privacy Act itself wouldn't be sufficient to help our clients in the face of DOGE's mass data-plundering.

18/

Finally, the court ruled that our claims will allow us to pursue APA cases because OPM and DOGE were behaving in an "arbitrary and capricious" manner, and exceeding its legal authority.

All of this is still preliminary - we're not at the point yet where we're actually arguing the case. But standing is a huge deal. Ironically, it's when governments violate our rights on a mass scale that standing is hardest to prove.

19/

Our *Jewel* case, over NSA spying, foundered because the US government argued that we couldn't prove our clients had been swept up by NSA surveillance because the details of that surveillance were officially still secret, even though Snowden had disclosed their working a decade earlier, and our client Mark Klein (RIP) had come forward with documents on illegal mass NSA spying in *2006*!:

eff.org/deeplinks/2022/06/effs…

20/

EFF’s Flagship Jewel v. NSA Dragnet Spying Case Rejected by the Supreme Court

We all deserve the right to have a private conversation online. That's why EFF has taken on government surveillance for the past 30-plus years.

^{Electronic Frontier Foundation}

So this is a big deal. It means we're going to get to go to court and argue the actual merits of the case. Things are pretty terrible right now, but this is a bright light. It makes me proud to have spent most of my adult life working with EFF. If you want to get involved with EFF, check and see if there's an Electronic Frontier Alliance affinity group in your town:

efa.eff.org/allies

21/

I'm on a 20+ city book tour for my new novel *Picks and Shovels*.

Catch me in #PITTSBURGH on May 15 at WHITE WHALE BOOKS:

whitewhalebookstore.com/events…

And in #PDX on Jun 20 at Barnes and Noble:

stores.barnesandnoble.com/even…

More tour dates here:

martinhench.com

22/

Image:
Cryteria (modified)
commons.wikimedia.org/wiki/Fil…

CC BY 3.0
creativecommons.org/licenses/b…

--

EFF (modified)
eff.org/files/banner_library/o…

CC BY 4.0
creativecommons.org/licenses/b…

eof/