U.S. District Judge Colleen Kollar-Kotelly found that the IRS had erroneously shared the taxpayer information of thousands of people with the Department of Homeland Security as part of the agencies’ controversial agreement to share information on immigrants for the purpose of identifying and deporting people illegally in the U.S.

Her finding was based off a declaration filed earlier this month by Dottie Romo, IRS’ chief risk and control officer, which revealed that the IRS had provided DHS with information on 47,000 of the 1.28 million people that ICE requested — and, in most of those cases, gave ICE additional address information in violation of privacy rules created to protect taxpayer data.

Kollar-Kotelly said in her Thursday decision that the agency violated IRS Code 6103, one of the strictest confidentiality laws in federal statute, “approximately 42,695 times by disclosing last known taxpayer addresses to ICE.” She called the Romo declaration “a significant development in this case.”

“The IRS not only failed to ensure that ICE’s request for confidential taxpayer address information met the statutory requirements, but this failure led the IRS to disclose confidential taxpayer addresses to ICE in situations where ICE’s request for that information was patently deficient,” she wrote.

The government is appealing the case, but the Thursday ruling is significant because Romo’s declaration supports the decision on appeal.

Nina Olson, founder of the Center for Taxpayer Rights, which has sued the government over the disclosure, says “this confirms what we’ve been saying all along: that the IRS has an unlawful policy that violates the Internal Revenue Code’s protections by releasing these addresses in a way that violates the law’s requirements.”

Representatives from the IRS and Treasury Department did not respond to Associated Press requests for comment.

A data-sharing agreement signed last April by Treasury Secretary Scott Bessent and Homeland Security Secretary Kristi Noem allows ICE to submit names and addresses of immigrants inside the U.S. illegally to the IRS for cross-verification against tax records. The deal led the then-acting commissioner of the IRS to resign.

There are several ongoing cases that challenge the IRS-DHS agreement.

Earlier this week, a three-judge panel for the U.S. Court of Appeals for the D.C. Circuit declined to issue a preliminary injunction for the immigrants’ rights group, Centro de Trabajadores Unidos, and other nonprofits that are suing the federal government to stop implementation of the agreement.

In declining the preliminary injunction request, Judge Harry T. Edwards wrote that the nonprofit groups “are unlikely to succeed on the merits of their claim,” since the information the agencies are sharing isn’t covered by the IRS privacy statute.

Still, two separate court orders have blocked the agencies from massive transfers of taxpayer information and blocked ICE from acting upon any IRS data in its possession. Those preliminary injunctions are still in place.