DOGE Access to Government Data: Privacy Act Suits and SSA Stay

Since January 2025, the Department of Government Efficiency has been sued more than a dozen times over its access to federal databases holding Social Security numbers, tax returns, medical records, and federal employee files. The DOGE government data access lawsuits have produced a split record: federal judges have blocked or restricted DOGE at the Treasury Department, the Office of Personnel Management, the IRS, and briefly the Social Security Administration, while other judges have declined to intervene at the Labor Department, Health and Human Services, and in a separate Treasury case. The Supreme Court stepped in once, in June 2025, to let DOGE resume access to Social Security records while appeals continue. Most of the injunctions rest on the Privacy Act of 1974.

How DOGE Obtained the Data

Executive Order 14158, signed on January 20, 2025, created DOGE inside the Executive Office of the President and directed agencies to give it “full and prompt access to all unclassified agency records, software systems, and IT systems.”¹ Within weeks, DOGE staff sought or obtained access to systems at Treasury, SSA, OPM, the Department of Education, the Department of Labor, HHS, HUD, and the VA. At Treasury, one DOGE staffer was reportedly granted “read/write” permissions over part of the Bureau of the Fiscal Service payment system, which handles trillions of dollars annually and stores Social Security numbers, bank account information, and home addresses.² At OPM, DOGE reached personnel files containing background checks, medical records, and biometric data on current and former federal workers.

The Legal Theory Behind Nearly Every Suit

Almost every lawsuit turns on the Privacy Act of 1974, a post-Watergate statute that bars federal agencies from disclosing personal records without written consent unless a specific exception applies. The law permits sharing with agency officials who have a “need for the record in the performance of their duties,” but courts examine whether that access was actually necessary, not just authorized on paper.¹ Plaintiffs have argued that DOGE personnel, many without background checks, security clearances, or privacy training, could not credibly claim a “need to know.”³ The administration has responded that the executive order supplies that authority. Courts have generally rejected the argument that an executive order can override the Privacy Act. By mid-2025, at least 12 active lawsuits alleged Privacy Act violations tied to DOGE.

Treasury Department: New York v. Trump

In early February 2025, 19 Democratic attorneys general sued in the Southern District of New York to block DOGE from Treasury payment systems, arguing the access exposed sensitive financial data and heightened the risk of fraud and intrusion.⁴ On February 7, 2025, Judge Paul Engelmayer issued a temporary restraining order and directed any staffers who had already reached the Bureau of the Fiscal Service to “immediately destroy any and all copies of material downloaded from the Treasury Department’s records and systems.”⁵ On February 21, 2025, Judge Jeannette Vargas converted that order into a preliminary injunction, allowing access only for civil servants with background checks, clearances, and system-specific training.⁶ The injunction was modified in May 2025. The government’s interlocutory appeal is pending at the Second Circuit.⁷

A parallel Treasury challenge in the District of Columbia went the other way. On March 7, 2025, Judge Colleen Kollar-Kotelly denied a preliminary injunction, finding the individual plaintiffs had not shown irreparable harm. She called their concerns “understandable and no doubt widely shared” but found no evidence of an imminent plan to publicly disclose private information.⁸ Her ruling did not disturb the New York injunction, which continues to block DOGE from Treasury payment systems.

Social Security Administration: AFSCME v. SSA

On February 21, 2025, AFSCME, the Alliance for Retired Americans, and the American Federation of Teachers sued in the District of Maryland, naming SSA, Elon Musk, and agency officials. They alleged Privacy Act violations tied to DOGE access to Social Security numbers, employment data, and medical histories.⁹ Judge Ellen Lipton Hollander granted a temporary restraining order on March 20, 2025, describing DOGE’s approach as “tantamount to hitting a fly with a sledgehammer.” After the Fourth Circuit rejected the government’s bid to lift the TRO, she issued a 148-page opinion and a preliminary injunction on April 17, 2025. It barred DOGE staff from non-anonymized SSA data, required deletion of any such data already in their hands, and prohibited access to or alteration of Social Security code. Anonymized data remained available to DOGE members who had completed privacy training.¹⁰ Judge Hollander called the government’s justifications for “unprecedented, unfettered access” “imprecise, contradictory, and insufficient.”¹¹

The Supreme Court Stay

On June 6, 2025, the Supreme Court granted the government’s stay application, letting DOGE team members access SSA records while the Fourth Circuit appeal continued. The per curiam opinion applied the four-factor test from Nken v. Holder. Justice Ketanji Brown Jackson, joined by Justice Sonia Sotomayor, dissented. Jackson wrote that the government had shown no concrete or irreparable harm from the injunction and was merely frustrated at being “constrained by law.” She noted that the district court’s injunction still permitted anonymized access, or non-anonymized access with a written justification, and called the majority’s decision “systemically corrosive.”¹¹

The January 2026 Disclosures

In January 2026, the Justice Department filed a document in the Maryland court acknowledging DOGE activities that were “potentially outside of SSA policy and/or noncompliant” with the earlier restraining order.¹² The filing described three problems. DOGE representatives had shared SSA data through a third-party Cloudflare server that was not approved for agency data, and because the server was external, SSA could not determine what was shared or whether it remained there.¹³ Two DOGE employees had been in contact with an unnamed political advocacy group seeking to analyze state voter rolls to “find evidence of voter fraud and to overturn election results,” and one signed a “Voter Data Agreement” with the group in their capacity as an SSA employee, without agency knowledge or approval. One DOGE team member was briefly granted access to private Social Security profiles after the court had prohibited it. Another had access to a “call center profile” containing private information for two months. Senior adviser Steve Davis was copied on an email with a password-protected file holding the personal information of roughly 1,000 people, a file SSA has been unable to open.¹⁴

SSA referred both employees involved in the voter data communications for potential Hatch Act violations.¹³ By mid-April 2026, Judge Hollander lifted a pause on the case and granted the plaintiffs discovery into the voter data agreement, the Cloudflare server use, and whistleblower allegations that a former DOGE staffer may have removed Social Security data.¹⁵

Office of Personnel Management

The American Federation of Government Employees and others sued OPM, arguing the agency had handed “unvetted and untrained” DOGE agents broad access to IT systems containing personal data on current and former federal employees. On June 9, 2025, Judge Denise Cote granted a preliminary injunction restricting that access. She found OPM had “violated the law and bypassed its established cybersecurity practices” and had “disclosed OPM records to individuals who had no legal right of access to those records.” She rejected the government’s defense in blunt terms: “The government has defended this lawsuit by repeatedly invoking a mantra that it adhered to all established procedures and safeguards. It did not.”¹⁶

The Electronic Privacy Information Center and an anonymous federal worker filed a separate suit in the Eastern District of Virginia, describing the situation as “the largest and most consequential data breach in U.S. history.” Judge Rossie Alston denied a temporary restraining order in February 2025 but noted that “further evidence of disclosure of tax information or other personal data… could lead to a different outcome.”¹⁷ In March 2026, a D.C. federal judge denied the government’s motion to dismiss a related proposed class action, ruling that plaintiffs had sufficiently alleged “factual injuries” from the disclosure of sensitive information.¹⁸

Department of Education: AFT v. Bessent

The American Federation of Teachers filed suit in the District of Maryland on February 10, 2025. Judge Deborah Boardman issued a temporary restraining order on February 24 blocking the Department of Education from disclosing personally identifiable information to DOGE affiliates.¹⁹ On March 24, 2025, she expanded the order into a preliminary injunction covering Education, OPM, and Treasury, finding that the government had already disclosed personal records to DOGE affiliates.²⁰ The Fourth Circuit vacated that preliminary injunction in August 2025 and sent the case back.

Labor and HHS: AFL-CIO v. Department of Labor

The AFL-CIO sued in February 2025 in the District of Columbia over DOGE access at the Department of Labor, HHS, and the Consumer Financial Protection Bureau. The case, before Judge John D. Bates, became the first to produce discovery into DOGE’s data operations. Depositions indicated agencies were “forced to provide DOGE unfettered access” to sensitive data while ignoring established protections.²¹ The court found DOL had given DOGE members access to financial systems containing employee Social Security numbers and contractor information, and HHS had granted access to “highly sensitive information” about Medicare patients, including names and clinical data.²²

On June 26, 2025, Judge Bates denied a preliminary injunction, finding the plaintiffs had not shown “irreparable harm.” He wrote that the court could not intervene “absent evidence those personnel will imminently misuse or publicly disclose that information.”²³ By March 2026, he denied both sides’ motions for summary judgment, citing “real disputes over facts foundational to plaintiffs’ APA claims,” and indicated he would compel disclosure of further information about DOGE-affiliated workers.²²

IRS: Center for Taxpayer Rights v. IRS

On February 17, 2025, the Center for Taxpayer Rights and other groups sued in the District of Columbia to keep DOGE out of IRS systems, alleging violations of Section 6103 of the Internal Revenue Code, the Privacy Act, and the Administrative Procedure Act. The district court granted a preliminary injunction in September 2025 and a second injunction in November 2025 to stop the mass sharing of taxpayer data with Immigration and Customs Enforcement. In February 2026, the IRS confirmed in a court filing that it had provided confidential taxpayer information to Department of Homeland Security officials. The government’s appeal to the D.C. Circuit is being briefed.²⁴

CREW v. DOGE: Is DOGE Even an Agency?

Citizens for Responsibility and Ethics in Washington filed a FOIA lawsuit in the District of Columbia arguing that DOGE is an “agency” subject to FOIA and the Federal Records Act. Judge Christopher Cooper issued a preliminary injunction on March 10, 2025, finding CREW likely to succeed, and ordered limited discovery including depositions of Acting DOGE Administrator Amy Gleason.²⁵ In December 2025, the D.C. Circuit unanimously denied the government’s attempt to block that discovery, holding that “longstanding FOIA precedent establishes that determining an EOP component’s agency status is a functional analysis that may require discovery.” Discovery was paused for 90 days to give the government time to seek Supreme Court review.²⁶

The Whistleblower Complaint Feeding the SSA Case

Much of what plaintiffs now know about DOGE’s internal handling of Social Security data came from Charles Borges, SSA’s Chief Data Officer for eight months before he resigned on August 29, 2025, alleging constructive discharge. Borges said DOGE staff copied a live copy of SSA’s Numerical Identification System database, which holds personal information on more than 300 million Americans, into a custom cloud environment within the agency’s Amazon Web Services infrastructure that lacked verified security controls and standard agency visibility.²⁷ He described the arrangement as “gross mismanagement, abuse of authority, violation of law, and substantial and specific threat to public health and safety.” He said no personnel outside DOGE-affiliated staff had insight into the code used, and that an internal SSA risk assessment placed the likelihood of a “catastrophic adverse effect” from a data breach between 35 and 65 percent.²⁸ Borges filed complaints with the Office of Special Counsel and Congress before resigning. Former Acting SSA Commissioner Leland Dudek publicly called Borges’s concerns “accurate” and “appropriate.”²⁹

SSA Commissioner Frank Bisignano has disputed those accounts, calling the environment a “secured server in the agency’s cloud infrastructure” that is “continuously monitored and overseen.”³⁰ In March 2026, the SSA Inspector General notified congressional leaders it was reviewing an anonymous whistleblower complaint regarding “potential misuse of SSA data by a former DOGE employee.”³¹

Congressional Oversight Running Alongside the Courts

Senator Gary Peters, ranking Democrat on the Senate Homeland Security and Governmental Affairs Committee, directed staff oversight visits to SSA, GSA, and OPM during 2025. The committee’s September 2025 report found DOGE personnel at those three agencies were operating without accountability to agency leadership or congressional oversight, and that letters sent to 23 executive branch agencies demanding information about DOGE activities received no substantive responses.³² The report documented efforts to pool sensitive personal information from multiple agencies into what it called a “master database,” and identified instances where NUMIDENT data appeared at DHS in an “unusual format,” suggesting it had bypassed standard interagency data-sharing agreements. The committee recommended shutting down the cloud environment containing NUMIDENT data and terminating DOGE personnel access to all personally identifiable information until compliance with federal security and privacy statutes could be certified.³³ House Oversight Committee ranking member Robert Garcia has formally requested that SSA answer questions about DOGE’s access and called on former DOGE staffers to come forward. Senators Ron Wyden, John Larson, and Richard Neal have called for a “full public accounting” and a “full investigation with accountability.”³¹

Where the Cases Stand Now

As of mid-2026, the litigation is fractured. The Supreme Court’s stay lets DOGE access SSA records while the Fourth Circuit weighs the appeal, but the January 2026 disclosures about the voter data agreement and the Cloudflare server prompted Judge Hollander to reopen discovery.¹⁵ The Treasury injunction from the attorneys general’s case remains in effect pending the Second Circuit appeal.⁷ The OPM injunction restricting DOGE access stands.¹⁶ The IRS injunctions are on appeal at the D.C. Circuit.²⁴ The AFL-CIO’s Labor/HHS challenge is heading toward further fact-finding after summary judgment was denied.²² The Fourth Circuit vacated the Department of Education preliminary injunction and remanded.¹⁹ The CREW FOIA case awaits potential Supreme Court review of the discovery order.²⁶ The SSA Inspector General’s inquiry into potential data misuse by a former DOGE employee is ongoing.³¹

1
Brookings. Privacy Under Siege: DOGE’s One Big Beautiful Database
2
The Leadership Conference on Civil and Human Rights. DOGE and Government Data Privacy
3
UC Law Review. Data, Democracy, and DOGE: The Privacy Act of 1974 and the Legal Battle Over DOGE’s Access to Personal Information
4
Massachusetts Attorney General. AG Campbell Challenges DOGE’s Unauthorized Access to Americans’ Private Data
5
Courthouse News Service. Federal Judge Blocks DOGE’s Access to Treasury Payment System as States Sue Trump Administration
6
News From the States. Democratic AGs Win Preliminary Injunction Against DOGE Access to Treasury Payment Systems
7
Oregon Department of Justice. DOGE Access to Treasury Payment Systems — New York v. Trump
8
Democracy Docket. Judge Will Not Restrict DOGE Treasury Data
9
Democracy 2025. American Federation of State, County and Municipal Employees, AFL-CIO v. Social Security Administration
10
NPR. DOGE Data Social Security
11
Supreme Court of the United States. Social Security Administration v. AFSCME, No. 24A1063
12
FedScoop. DOGE Access Social Security Data Court Filing
13
Axios. DOGE Employees Social Security Information Court Filing
14
Politico. Trump Musk DOGE Social Security
15
Democracy Docket. Court Orders Probe of DOGE’s Secret Voter Data Deal
16
Federal News Network. Judge Finds OPM Broke Law in Granting Data Access to DOGE
17
EPIC. EPIC v. OPM — DOGE Privacy Violations
18
Law360. Treasury, OPM Must Face Privacy Suit Over DOGE Info Access
19
Civil Rights Litigation Clearinghouse. American Federation of Teachers v. Bessent
20
Protect Democracy. Federal Court Issues Order Stopping DOGE From Accessing Private Data
21
Democracy Forward. Labor and Economic Organizations Ask Judge to Stop DOGE Access to Three Federal Agencies
22
Bloomberg Law. DOGE Data Access Lawsuit Shifts to Fight Over Employment Status
23
The Hill. Judge Won’t Block DOGE Access to Sensitive Government Data
24
Democracy Forward. Organizations File Emergency Suit to Stop DOGE’s Unlawful Access to Taxpayer Data From IRS
25
Supreme Court of the United States. In Re United States DOGE Service, Response in Opposition to Stay Application
26
Citizens for Responsibility and Ethics in Washington. DC Circuit Unanimously Denies DOGE Effort to Block Discovery in CREW FOIA Lawsuit
27
FedScoop. Social Security Administration Chief Data Officer Resignation Whistleblower Complaint
28
FedScoop. DOGE Social Security Database Whistleblower Cloud Environment Data Vulnerabilities
29
Katz Banks Kumin LLP. Social Security Administration Whistleblower Files Retaliation Complaint With the Office of Special Counsel
30
Ars Technica. Senate Staff Probes DOGE, Finds Locked Doors and Windows Covered With Trash Bags
31
NPR. DOGE Social Security Data Whistleblower Investigation
32
HSGAC. Peters Report Finds That DOGE Continues to Operate Unchecked
33
HSGAC. Unchecked and Unaccountable: How DOGE Jeopardizes Americans’ Data