In a 39-page ruling released on Tuesday, Judge Denise Cote said OPM violated the Privacy Act of 1974, a post-Watergate law which prohibits the disclosure of certain records and outlines requirements for safeguarding others, and subsequently disobeyed its own cybersecurity practices.

OPM failed to provide a credible reason for why DOGE would need access to personally identifiable information (PII) of tens of millions of federal employees, as well as applicants and retirees, according to Cote. 

“The defendants barely defend its legality, relying instead on what has happened since to argue that the case is moot and that prospective relief is unnecessary,” Cote wrote in her ruling.

Musk assembled DOGE in the first days of President Donald Trump’s second term, claiming the special advisory would root out waste, fraud, and abuse in the federal government. While DOGE claims to have saved the government $215 billion in cancelled contracts and the reduction of approximately 300,000 government workers, former federal employees, including former IRS acting Commissioner Douglas O’Donnell, have warned the sweeping cuts will have lasting impacts on the government’s ability to increase efficiency through updated technology.

The Department of Justice (DOJ), which served as the legal team for OPM, argued in previous court filings that DOGE agents required access to sensitive data—including employee records, background checks, medical files, and banking information—as part of the group’s workforce modernization efforts. However, previous government modernization initiatives have not required access to such information, Cotes said, and the administration never made a connection between the access to data and DOGE agents’ responsibilities.

Cotes also rejected the government’s argument that the lawsuit was moot because DOGE is no longer a centralized entity. While DOGE agents have had access to sensitive OPM data since September 2025, one former agent is not employed at OPM, Cotes said. She did not offer a final remedy for the case.

OPM and DOJ did not respond to Fortune’s requests for comment.

Policy experts and federal workers share privacy concerns

A coalition of unions, including the AFL-CIO, filed a lawsuit against DOGE and the Department of Labor in February 2025, challenging the special advisory’s access to private information. 

At the time, Musk justified the increased access as a means to reconcile variabilities in how government data was stored and displayed.

“These databases don’t talk to each other,” Musk said in a Fox News interview last February. “And that’s really the source of, that’s the biggest vulnerability for fraud, is the fact that these databases don’t talk to each other. So we need to reconcile the databases. It’s a, frankly, painful homework, but it has to be done, and will greatly improve the efficiency of the government systems.”

Policy experts, however, have warned DOGE’s access to government data could present significant cybersecurity and privacy risks, such as private-sector engineers without clearances having sensitive information on personal devices, as well as the increased vulnerability of a centralized database to hackers.

“Being able to amass all of that information will give the federal government unprecedented power and control to do with that information a number of things that we just haven’t experienced as a country before,” Elizabeth Laird, the director of equity in civic technology at technology policy nonprofit the Center for Democracy and Technology, told Fortune last year. 

Even if the dissemination of the data was legally permissible, Laird argued, it would still be a threat to the security of the information. 

“Something can be private, and something can be secure, and it can be legal,” she added. “And it can still be a bad idea.”