EPIC v. OPM (DOGE Privacy Violations)

Challenging the DOGE’s illegal access to vast amounts of personal information from federal workers and the general public.

Summary

In February 2025, EPIC and an anonymous federal worker—together with counsel from Democracy Forward and The Kaplan Law Firm—brought suit against the U.S. Treasury Department, the Office of Personnel Management (OPM), and the Elon Musk-run “Department of Government Efficiency” (DOGE) over an unprecedented series of privacy and data security violations implicating the personal information of tens of millions of people.

As the complaint sets out, the DOGE illegally forced Treasury and OPM to disclose vast stores of personal information from government workers and everyday Americans to unauthorized, untrained personnel with no legitimate purpose to access such data. These actions violated the Privacy Act, the Federal Information Security Modernization Act, the Internal Revenue Code, and the Fifth Amendment right to information privacy. Together they constitute “the largest and most consequential data breach in U.S. history,” as the complaint explains.

Background

On the day of his second inauguration, January 20, 2025, President Trump signed Executive Order 14158, Establishing and Implementing the President’s “Department of Government Efficiency,” which reorganized and renamed the United States Digital Service (USDS) as the United States DOGE Service. The Order also requires each Agency Head to establish a “DOGE Team” comprised of at least four employees within their respective agencies.

DOGE consists a network of individuals located at OPM, the General Services Administration, and the USDS and embedded at agencies throughout the federal government. DOGE Team members formally assume titles as employees of or detailees to those agencies; however, DOGE Team members do not serve as normal agency employees or detailees. They are there to carry out an externally imposed agenda coordinated by DOGE leaders outside their host agencies.

Beginning on Inauguration Day, DOGE sought and obtained unprecedented access to information systems across numerous federal agencies, including the Office of Personnel Management and the Department of Treasury. Under normal circumstances, these systems and the vast amount of personal data they contain are protected by laws like the Privacy Act of 1974, the Federal Information Security Modernization Act, and the confidentiality provisions of the Internal Revenue Code. Yet at the direction and insistence of DOGE, OPM and Treasury have abandoned these safeguards, relinquishing control of systems and, without legal basis, disclosing vast stores of personal information to individuals unauthorized by law to access them, including DOGE personnel.

At the Treasury Department, DOGE forcibly gained access to systems and databases of personal information administered by the Bureau of Fiscal Service (BFS). BFS distributes nearly 90% of all federal payments, including Social Security benefits, tax refunds, and vendor payments. BFS payment systems contain vast amounts of sensitive personal data of tens of millions of individuals. As one example, the BFS’s Integrated Document Management System contains personally identifying information for “10,000,000–99,999,999” individuals, including Social Security Numbers, personal taxpayer identification numbers, personal financial information, taxpayer information/return information, dates of birth, addresses, zip codes, phone numbers, email addresses, marital statuses, spouse information, information on children, mother’s maiden names, military service information, employee identification numbers, health plan beneficiary numbers, patient ID numbers, file/case ID numbers, medical/health information, and mental health information, worker’s compensation information, disability information, and emergency contact information.

Plaintiffs’ Lawsuit

On February 10, 2025, EPIC and an unnamed federal worker—represented by counsel at Democracy Forward and The Kaplan Law Firm—filed suit against OPM, the Treasury Department, DOGE, and several key officials. The complaint (and the subsequent amended complaint) detail how the DOGE illegally forced Treasury and OPM to disclose vast stores of personal information from government workers and everyday Americans to unauthorized, untrained personnel with no legitimate purpose to access the data. The plaintiffs explained how these actions violated the Privacy Act, the Internal Revenue Code, and the Fifth Amendment right to information privacy, among other laws. 

On February 13, 2025, the Plaintiffs moved for a temporary restraining order halting DOGE access to databases of personal information at OPM and the Treasury Department. Although Judge Rossie Alston of the Eastern District of Virginia concluded that EPIC and the government worker were not entitled to an injunction at that time, he expressed openness to the plaintiffs’ standing to bring their case, and he warned that further evidence of disclosure of tax information or other personal data from Treasury and OPM systems could lead to a different outcome. 

On May 6, 2025, the plaintiffs filed an amended complaint. On June 3, the government moved to dismiss the complaint. The plaintiffs filed an opposition to that motion on June 17.

EPIC’s Interest

EPIC has long advocated for robust safeguards to protect Americans’ personal information. EPIC has called for greater transparency in the government’s data collection and privacy practices and brings lawsuits against government entities that have threatened Americans’ civil liberties. EPIC routinely monitors, analyzes, and educates the public about the collection, use, retention, and transfer of personal information by federal agencies, including large-scale databases and mass surveillance programs.

For decades, EPIC has made extensive use of public notices and records concerning the collection, use, retention, and transfer of personal information by federal agencies. These include Systems of Records Notices mandated by the Privacy Act and Privacy Impact Assessments mandated by section 208 of the E-Government Act.

Since January 2025, EPIC has closely tracked the Administration’s efforts to consolidate and increase its access to personal information maintained by federal and state governments. This includes Executive Order 14243, Stopping Waste, Fraud, and Abuse by Eliminating Information Silos (March 20, 2025), the order cited as the basis for USDA’s recent demand for state-level SNAP beneficiary data. Over that time, EPIC has published analysis, developed public resources, provided expertise to lawmakers and members of the press, undertaken litigation, and engaged in extensive advocacy concerning the privacy, security, and legal risks of the Administration’s data consolidation activities.