Doge’s Play For Government Data Is Straining A Law Inspired By Watergate

A rarely tested 50-year-old law meant to protect sensitive information on millions of Americans is becoming a last-ditch tool to slow Elon Musk's push to disrupt the federal government.

At least a dozen lawsuits trying to stop the billionaire’s Department of Government Efficiency from tapping into tax records, student loan accounts and other troves of personal data have invoked the Privacy Act of 1974 since January.

The Watergate-inspired law ostensibly prevents agencies from sharing sensitive information with unauthorized parties, even within the federal government — exactly what many of Musk’s critics allege DOGE is forcing them to do. Now it has surfaced as one of the few legal avenues state attorneys general, unions and associations believe can curb DOGE’s agency incursions so far.

But because previous Republican and Democratic administrations have largely attempted to abide by the law — which was meant to be a constraint on federal power — its limits and authority are now facing their first real test in court.

“There appears to be no precedent with similar facts,” Judge Deborah Boardman for the U.S. District Court of Maryland, a Biden appointee, wrote in her opinion granting a temporary block on DOGE’s access to education and government personnel records. “This case involves the alleged unauthorized disclosure of millions of records. Even under existing precedent, this appears to be unlawful.”

As the cases move forward, it’s unclear if the Privacy Act can hold up when the government itself seems indifferent to violating it.

Boardman is one of two judges who have issued temporary blocks on DOGE’s data access. Four other judges have ruled that the plaintiffs haven’t been able to show that they’re being harmed — a common hurdle for lawsuits that may prove difficult for the Privacy Act to overcome.

None of the judges has issued a final ruling on whether DOGE is breaking the law. But even their temporary ones highlight the sense of dread many government watchdogs are feeling as Musk’s operation prods the generations-old standard.

“In normal times, agencies are the primary enforcement mechanism for federal laws that address how agencies are structured and should behave,” John Davisson, the director of litigation at the Electronic Privacy Information Center, which is suing the Trump administration for Privacy Act violations. “These obligations are taken seriously, and when that drops away, when you suddenly have a top-down policy of non-enforcement or disregard for these statutes, you have to fall back on the alternative methods of enforcement, and that is the courts.”

The Privacy Act was originally passed out of concern that centralized access to everyone’s information could lead to an abuse of power — both in the wake of Watergate and in the emerging computer age. And since then the government has collected ever-large heaps of data on people, everything from income to citizenship status to addresses.

“They worried about overweening government power that needed to be constrained,” Danielle Citron, a University of Virginia law professor whose paper “A More Perfect Privacy” was cited in Boardman’s order, said of the law’s authors. “This is the scenario that would get them out of bed and say, ‘This is what we worried about.’”

Federal agencies have also dedicated people and money toward compliance with the law, including clear direction about which entities they’re allowed to share the data with.

To stay within Privacy Act boundaries, the General Services Administration awarded a $34 million contract to outside vendors for identity verification in 2021 for data such as Social Security numbers rather than tapping the Social Security Administration directly.

Opponents of DOGE’s data requests say the Trump administration is in direct violation of the law because DOGE is essentially an outside group accessing sensitive data.

“The government’s position, which the court did not agree with, was that a political appointee should in effect be able to access the information just as other authorized employees can,” said Kristin Woelfel, a policy counsel for the Center for Democracy and Technology, a progressive tech nonprofit group in D.C.

The Trump administration argues that providing DOGE employees access to government databases doesn’t violate the Privacy Act because those staffers are authorized to access information under the president’s executive order to reduce the federal bureaucracy.

It appears to be using tactics to give itself Privacy Act authority, such as appointing DOGE workers within agencies themselves, which has raised questions for judges considering the legality of the data mining.

A senior White House official said the handful of judges’ decisions support the Trump administration's defense that it did not violate the Privacy Act.

"The legal experts can say what they want, but the courts are the ultimate deciders," the official said in an emailed statement.

But even in the four cases where judges have declined to issue restraining orders, having decided that access to data alone didn’t necessarily amount to someone being harmed, the issue isn’t settled.

Temporary restraining orders have a much higher bar to pass because plaintiffs need to show there will be an “irreparable harm” unless an immediate pause is put in place — something that’s harder to demonstrate when there aren’t physical injuries at stake. But what remains in all 12 cases is perhaps the most important part: the fundamental question of whether the law has been broken.

Critics of DOGE claim the lack of transparency — to the point where even the government attorneys defending its access to data cannot explain in court how staffers are using and securing the information — has been an advantage for the government so far.

The lack of clarity has helped the Trump administration lawyers argue that fears of data leaks, heightened risks of identity theft and other potential violations stem from guesswork or misleading media reports about DOGE’s activities.

An anonymous University of California student filed a declaration in support of blocking DOGE’s access to student data, citing fear that information about her family could be used for immigration enforcement purposes.

D.C. District Court Judge Randolph Moss, a Barack Obama appointee, denied the request on the grounds that the students provided no evidence “beyond sheer speculation” that DOGE staffers would use the data for an unsanctioned purpose — a move that echoed with other judges.

But lawyers trying to find leverage against DOGE through the Privacy Act are confident the discovery process will uncover evidence of the government mishandling of sensitive data.

That step, when the federal government would have to open its books, may reveal new information about Musk’s operation and how DOGE employees are handling millions of Americans’ data.

“It’s almost a certainty that we will identify in different quarters of the government specific harmful ways that the personal information involved here was misused,” EPIC’s Davisson said.