On April 16, the U.S. District Court for the District of Columbia granted in part and denied in part the defendants’ motion to dismiss a case involving claims that DOGE and several federal agencies (including the DOL, the CFPB, and HHS) violated the APA and the Privacy Act by accessing sensitive information systems which contained confidential personnel and consumer records. As previously covered by InfoBytes, the plaintiffs filed an amended complaint alleging five counts against DOGE and each of the agency defendants based on DOGE’s access to sensitive databases containing employee and consumer data. The plaintiffs, including several large labor unions, a think tank, and two nonprofits, alleged that the defendant federal agencies violated the APA by providing DOGE access to agency systems, violating applicable statutes and regulations for each agency. The plaintiffs also claimed that DOGE and each federal agency defendant violated the Privacy Act by disclosing records without consent and that DOGE acted without any statutory authority in directing agency action.
Regarding the CFPB specifically, the plaintiffs had alleged that on February 7, three individuals associated with DOGE reportedly accessed CFPB systems, including those managing human resources, procurement and finance. The plaintiffs highlighted concerns about the potential exposure of personally identifiable information, as CFPB systems contain data from (i) over 10 million consumer complaints, including names, Social Security numbers, contact information, bank account information, routing numbers, credit card numbers, and credit history; (ii) HMDA data, including individual consumer data the CFPB does not disclose to the public to protect applicant and borrower privacy; and (iii) market monitoring information, which plaintiffs alleged may be valuable to DOGE’s leader in his non-governmental capacities by revealing information about competitors.
The plaintiffs previously asked the court to enjoin the agency defendants from sharing this data with DOGE. The court denied the plaintiffs’ request for a temporary restraining order (covered here), resulting in sparring motions to dismiss filed by both parties (covered here). In response to the defendants’ motion to dismiss, the court found that the plaintiffs adequately stated a claim under the APA on the grounds that the DOGE access policies are unlawful under the Privacy Act and other agency specific regulations. The court did, however, dismiss the plaintiffs’ APA claims to the extent that they relied on violations of the APA’s notice and comment requirement or relied on violations of other federal statutes, beyond the Privacy Act.
Next, the court found that, although the plaintiffs adequately stated an APA claim against the agencies based on violations of the Privacy Act, the plaintiffs could not establish a standalone Privacy Act claim under that statute’s private right of action. The court dismissed the standalone Privacy Act cause of action because the court held that the Privacy Act only provides a right of action for individual plaintiffs and plaintiffs are organizations — not individuals.
Finally, the court also declined to dismiss the plaintiffs’ common law ultra vires claim against DOGE, which alleged that DOGE lacks any statutory authority to direct operational and personnel decisions at congressionally-created agencies. The court found the plaintiffs’ ultra vires claim could proceed because defendants failed to identify any legal source granting DOGE authority to take the actions alleged in the plaintiffs’ complaint.
[View source.]
