AMERICAN FEDERATION OF LABOR AND CONGRESS OF INDUSTRIAL ORGANIZATIONS et al v. DEPARTMENT OF LABOR et al

1
UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
AMERICAN FEDERATION OF LABOR
AND CONGRESS OF INDUSTRIAL
ORGANIZATIONS, et al.,
Plaintiffs,
v. 	Civil Action No. 25-339 (JDB)
DEPARTMENT OF LABOR, et al.,
Defendants.
MEMORANDUM OPINION
In the summer of 1974, a storm was brewing in Washington. The Supreme Court had just
ordered President Nixon to release the Watergate tapes to investigators. Included was “the
Smoking Gun”—a recording of President Nixon and his chief of staff plotting to cover up
involvement in an illegal effort to wiretap the headquarters of the Democratic National Committee.
The American people were outraged at the President’s overreach. The House Judiciary Committee
voted on Articles of Impeachment, and President Nixon ultimately resigned.
Out of this tempest emerged the Privacy Act. The law’s principal sponsor, Judiciary
Chairman Senator Sam Ervin, advocated for its passage, testifying that “[i]f we have learned
anything in this last year of Watergate, it is that there must be limits upon what the Government
can know about each of its citizens.” 120 Cong. Rec. 12646 (1974) (statement of Sen. Sam Ervin).
Congress agreed, and on December 31, 1974, President Ford signed the Privacy Act into law. See
Privacy Act of 1974, Pub. L. No. 93-579, 88 Stat. 1896, 1896.
In its preamble, the Privacy Act declares federal agencies’ “increasing use of computers
and sophisticated information technology” both a boon and a scourge. Pub. L. No. 93-579, § 2,
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 1 of 48

2
88 Stat. 1896, 1896. While “essential to the efficient operations of the Government,” these
technologies “greatly magnif[y]” the harm to individual privacy that can occur from federal
collection, maintenance, use, or dissemination of personal information. Id. To counteract this
harm, the Act forbids federal agencies from disclosing records they maintain about individuals to
any person or any other agency without the prior consent of the person to whom the record pertains.
5 U.S.C. § 552a(b).
But the Privacy Act’s prohibition on disclosure of an individual’s government records
without consent is not absolute. The statute defines a list of exceptions to its disclosure bar, the
first of which balances the two interests the law identifies—individual privacy and government
efficiency. The exception allows agencies to disclose records they maintain “to those officers and
employees of the agency . . . who have a need for the record in the performance of their duties.”
Id. § 552a(b)(1). How far this exception extends lies at the heart of this case.
Turning the clock forward fifty years to the early months of 2025, affiliates of President
Trump’s Department of Government Efficiency (DOGE) descended on many federal agencies.
Armed with executive orders, these affiliates sought broad access to the sensitive records the
government holds. Officials at the Department of Health and Human Services (HHS) and the
Department of Labor (DOL) largely handed them the keys.
Plaintiffs, a collection of unions and nonprofit organizations, sued. See Am. Compl. [ECF
No. 21]. They alleged, among other things, that HHS, DOL, and the Consumer Financial
Protection Bureau (CFPB) violated the Administrative Procedure Act (APA) and the Privacy Act
by adopting a policy of granting DOGE affiliates access to their members’ records without consent.
See id. at 59–65 (Counts II–IV). They also alleged that the United States DOGE Service (USDS)
had acted ultra vires. See id. at 57 (Count I).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 2 of 48

3
After substantial motion practice and limited discovery, the parties and claims have
winnowed. The union plaintiffs now seek summary judgment on their APA and statutory ultra
vires claims against HHS, DOL and USDS (collectively, the defendants). Pls.’ Mot. [ECF No. 93-
2]. And the defendants have filed a cross-motion for summary judgment on all claims against
them. Defs.’ Mot. [ECF No. 95-1].
Following careful consideration of the parties’ briefing and the record, the Court holds that
plaintiffs have standing but denies the parties’ motions as to the remaining APA claims (Counts II
and IV) because genuine disputes of material fact exist. The Court grants summary judgment for
defendants on the statutory ultra vires claim (Count I) because plaintiffs have not identified a
specific, clear, and mandatory statutory provision that DOGE violated.
BACKGROUND
I. 	Factual Background
The Court recounts the story of this case in three acts, each opening with the promulgation
of an executive order.
A. The January 20 Executive Order
On January 20, 2025, shortly after his inauguration, President Trump signed an executive
order establishing the Department of Government Efficiency (DOGE) within the Executive Office
of the Presidency. See Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 29, 2025) (“January 20
Executive Order”). That Order renamed the existing United States Digital Service as “the United
States DOGE Service (USDS)” and directed USDS “to implement the President’s DOGE Agenda,
by modernizing Federal technology and software to maximize governmental efficiency and
productivity.” Id. § 1; see also id. § 4(a) (directing DOGE to “promote inter-operability between
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 3 of 48

4
agency networks and systems, ensure data integrity, and facilitate responsible data collection and
synchronization”).
The January 20 Executive Order required each agency head to “establish within their
respective Agencies a DOGE Team of at least four employees, which may include Special
Government Employees, hired or assigned within thirty days” of the Order. Id. § 3(c). It also
instructed agency heads to “take all necessary steps, in coordination with the USDS Administrator
and to the maximum extent consistent with law, to ensure USDS has full and prompt access to all
unclassified agency records, software systems, and IT systems.” Id. § 4(b). The January 20
Executive Order further mandated that USDS “adhere to rigorous data protection standards.” Id.
DOGE arrived at HHS the very next day. Luke Farritor, a recent hire by the General
Services Administration, accepted a detail to HHS on January 21, 2025. See Defs.’ Interrog. Resp.
[ECF No. 80-5] at 6–7. Farritor was also detailed to USDS and CFPB. Id. at 6–7, 21.1
On Farritor’s second day as an HHS detailee, HHS granted him administrator access to his
first agency system containing personally identifiable information (PII) or personal health
information (PHI)—the Agency’s Payment Management System (PMS). See id. at 7. PMS
facilitates the electronic transmission of grant funds to HHS grantees and contains the social
security numbers of those grantees, among other PII. HHS 30(b)(6) Dep. (Wendel) Chart [ECF
No. 80-14] at 2. Because of the PII in PMS, HHS adheres to the principle of least privilege and
grants system access only to users with (1) a need to use that information as part of their official
duties and (2) who have security level VI clearance or higher. Id.; see also HHS, Privacy Impact
Assessment for Payment Management System 7–8 (Sep. 20, 2017), https://perma.cc/C3WF-3L55.
1 Farritor may have been detailed or employed at other agencies, too, but HHS has thus far refused to
disclose how many agencies he was concurrently detailed to or otherwise employed by. See id. at 5–7.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 4 of 48

5
Over the following weeks, HHS granted Farritor access to eight other systems containing
PII or PHI (“sensitive systems”) at the Agency, two of which he accessed: HHS Consolidated
Acquisition Solution (HCAS) and NIH ES Electronic Research Administration (eRA). Defs.’
Interrog. Resp. at 7–8, 11. HCAS supports contract writing and contains PII incidental to those
contracts; eRA supports NIH research grant management and contains grantee PII. HHS 30(b)(6)
Dep. (Wendel) Chart at 1–2.
In late January through mid-February, several other DOGE affiliates joined Farritor at
HHS, including Amy Gleason, Aram Moghaddassi, and Rachel Riley. Defs.’ Interrog. Resp. at 6,
11–12, 16. While Riley was hired directly as an HHS employee, Gleason and Moghaddassi’s
employment statuses are uncertain during this period.2 See id. Nevertheless, on February 19, HHS
granted Moghaddassi access to its GrantSolutions system. Id. at 12. And on February 24, the
Agency granted Gleason access to CMS’s Acquisition Lifecycle Modernization (CALM) system.
Id. at 6. These systems contain the PII of HHS grantees and vendors. HHS 30(b)(6) Dep. (Wendel)
Chart at 1–2.
Meanwhile, DOL also stood up its DOGE team. On February 19th and 20th, Moghaddassi
and Mike Collins—both new hires at DOL and members of the Agency’s DOGE team—were
granted access to DOL’s New Core Financial Management System (NCFMS) and its HRConnect
system. Defs.’ Interrog. Resp. at 18–20. NCFMS is DOL’s financial backbone and contains
employee social security numbers and EIN information for contractors. DOL 30(b)(6) Dep. [ECF
No. 80-9] at 126. HRConnect is DOL’s instance of PeopleSoft, a HR software solution. DOL,
2 Gleason was eventually hired as an HHS employee but that did not occur until March 5. See Gleason
Appointment Aff. [ECF No. 65-1]. Moghaddassi, too, eventually entered into a formal employment relationship
with HHS. DOL detailed him there on March 5. Defs.’ Interrog. Resp. at 11.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 5 of 48

6
Rep. of Off. of the Assistant Sec’y for Admin. and Mgmt. 22 (Nov. 2016), https://perma.cc/S8F5-
MQ7Y.
On February 25, Marko Elez, a DOL and Treasury dual new hire and detailee to USDS,
and to at least three other agencies, was granted access to three additional sensitive systems at
DOL: USAccess, DOL Homeland Security Presidential Directive 12 Enterprise Physical Access
Control (EPACS), and DOL Directory Resource Administrator (DRA). Defs.’ Interrog. Resp. at
17–18. USAccess is the identity verification system for federal agencies, containing employee
names, birthdays, and social security numbers. GSA, About USAccess, https://perma.cc/Z7JS-
5CR4; see also Elez Access Request [ECF No. 80-13] at 2. The other systems appear to pertain
to physical and electronic access to DOL’s facilities and assets by its employees.
B. The February 26 Executive Order
President Trump issued a second executive order redirecting DOGE’s focus away from
software modernization and towards cutting government spending on February 26, 2025. See
Exec. Order No. 14,222, 90 Fed. Reg. 11095 (Feb. 26, 2025) (“February 26 Executive Order”).
The February 26 Executive Order charged agency heads and DOGE Team leads with reviewing
“all existing covered contracts and grants.” Id. § 3(b). It also authorized agency heads and DOGE
team leads, where consistent with applicable law, to terminate or modify covered contracts and
grants to reduce federal spending, promote efficiency, and advance administration policy. Id.
The February 26 Executive Order defined covered contracts as “discretionary spending
through Federal contracts, grants, loans, and related instruments” but not “direct assistance to
individuals; expenditures related to immigration enforcement, law enforcement, the military,
public safety, and the intelligence community; and other critical, acute, or emergency spending.”
Id. § 2(d). The Order directed DOGE to “prioritize the review of funds disbursed under covered
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 6 of 48

7
contracts and grants to educational institutions and foreign entities for waste, fraud, and abuse.”
Id. § 3(b).
After this second executive order, HHS granted members of its DOGE team access to many
new systems. Those systems contain some of the most sensitive data the Agency holds.
Moghaddassi, by this point officially detailed to HHS, gained access to (and actually accessed)
HHS’s Integrated Data Repository (IDR) and its Healthcare Integrated General Ledger Accounting
System (HIGLAS). Defs.’ Interrog. Resp. at 11–12. IDR is “a cornerstone” of HHS’s data
environment. HHS 30(b)(6) Dep. (Wendel) Chart at 1. It contains data on Medicare beneficiaries,
providers, and health plans. Id.; see also CMS, Privacy Impact Assessment for Integrated Data
Repository Cloud (Dec. 5, 2023), https://perma.cc/3VKU-D8QF. Among the PII and PHI stored
in IDR are Medicare patient names, social security numbers, demographic information, contact
information, medical notes, and diagnosis codes. HHS 30(b)(6) Dep. (Wendel) Chart at 1.
HIGLAS, too, contains Medicare patient data, including names, social security numbers, contact
information, salaries, and health insurance claim numbers. Id.
Edward Corristine, a detailee from GSA to USDS and HHS, and Elez were also granted
access to IDR and HIGLAS, although it is unclear whether they logged into the systems. See
Defs.’ Interrog. Resp. at 8–10. And during this period, HHS granted Conor Fennessy, a
Department of Education detailee, access to six of its sensitive systems, two of which he accessed.
Id. at 12–13. The Agency also granted Jeremy Lewin, a GSA detailee, and Farritor access to two
additional sensitive systems each. Id. at 7, 14.
At DOL, access requests slowed somewhat following the February 26 Executive Order.
But a larger fight was brewing over the Agency’s Unemployment Insurance Data and Related
Records (“UIDRR”) system. UIDRR contains claims data from state unemployment insurance
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 7 of 48

8
agencies, including the names, social security numbers, and bank account information of
claimants. DOL 30(b)(6) Dep. at 59–60. At the time, UIDRR was housed within DOL’s Office
of the Inspector General and subject to strict access controls. See id. at 59, 62.
C. The March 20 Executive Order
On March 20, 2025, President Trump signed a third executive order aimed at “eliminating
bureaucratic duplication and inefficiency” and “enhancing the Government’s ability to detect
overpayments and fraud.” Exec. Order No. 14,243, 90 Fed. Reg. 13681 (Mar. 20, 2025) (“March
20 Executive Order”). The March 20 Executive Order directed agencies to tear down information
silos and “ensure Federal officials designated by the President or Agency Heads (or their
designees) have full and prompt access to all unclassified agency records, data, software systems,
and information technology systems,” including by “authorizing and facilitating both the intra-
and inter-agency sharing and consolidation of unclassified agency records.” Id. § 3(a).
The Order specifically referenced the unemployment data and payment records stored at
DOL’s Office of the Inspector General. It required that the Secretary of DOL and the Secretary’s
designees “[i]mmediately upon execution of this order” receive, “to the maximum extent
consistent with law, unfettered access” to this data. Id. § 3(d). So the next day, DOL’s CIO granted
Moghaddassi and Elez access to UIDRR. See Defs.’ Interrog. Resp. at 17–18.
DOGE data access grants also continued at HHS. On March 21, HHS granted Kyle Shutt,
a GSA employee who had been detailed to HHS since March 14, access to its Unaccompanied
Children Portal. Id. at 10. The Portal is a system maintained by the Office of Refugee
Resettlement and contains highly sensitive demographic and health data about unaccompanied
alien children, including photographs of the children. HHS 30(b)(6) Dep. (Wendel) Chart at 4.
The Portal also contains citizenship and financial data about the children’s sponsors. Id.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 8 of 48

9
Beyond mid-March 2025, the Court has little knowledge of DOGE’s activities at HHS and
DOL. HHS represents that its DOGE effort is ongoing, while DOL has averred that as of fall 2025,
no DOGE affiliates remain at the Agency. See Defs.’ Mot. at 27.
II. 	Procedural History
Plaintiffs filed this suit against DOL following media reports that DOGE was “going after
the Department of Labor” and that Agency staffers had “been ordered to give [DOGE personnel]
access to anything they want—or risk termination.” Compl. [ECF No. 1] ¶ 65. They moved for a
TRO and alleged that USDS was about to “enter . . . the Department of Labor and attempt to gain
access to sensitive systems” that contain the “data of millions of Americans and many federal
employees,” all in alleged violation of the Privacy Act. Mot. TRO [ECF No. 2] (“First TRO Mot.”)
at 19. Days later, the Court denied the motion because plaintiffs had failed to establish a substantial
likelihood of standing: they had put forward no evidence that their members would be harmed, nor
any evidence that the organizations had standing in their own right. See Am. Fed’n of Lab. &
Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO I”), 766 F. Supp. 3d 32, 37–39 (D.D.C. 2025).
After the Court’s ruling, plaintiffs filed an amended complaint, adding HHS and the
Consumer Financial Protection Bureau (“CFPB”) as defendants. See Am. Compl. They also
renewed their motion for a TRO. Renewed Mot. TRO [ECF No. 29]. In opposition to the renewed
motion, defendants submitted three affidavits that confirmed that DOGE affiliates—either directly
hired by the Agencies or detailed to the Agencies—were working at HHS, DOL and CFPB, and
either had been or would likely be permitted to access sensitive agency systems. See Decl. of R.
J. Kryger [ECF No. 31-1] (DOL); Decl. of G. Rice [ECF No. 31-2] (HHS); Decl. of A. Martinez
[ECF No. 31-3] (CFPB).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 9 of 48

10
The Court denied plaintiffs’ renewed TRO motion. See Am. Fed’n of Lab. & Cong. of
Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO II”), 766 F. Supp. 3d 105, 114 (D.D.C. 2025). It reasoned
that the Privacy Act permits an agency to disclose records to “employees of the agency . . . . who
have a need for the record[s] in the performance of their duties.” Id. at 110 (quoting 5 U.S.C.
§ 552a(b)(1)). And on the record as it stood, plaintiffs had not shown it was likely that the DOGE
affiliates were not “employees of the agency” with a “need for the record[s].” See id. at 110–13.
The Court granted, however, plaintiffs’ motion for limited expedited discovery. Am. Fed’n
of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO III”), 349 F.R.D. 243, 254 (D.D.C.
2025); Pls.’ Mot. Expedited Disc. [ECF No. 44]. And the Court reaffirmed its grant of limited
discovery after defendants submitted evidence that the Agencies were no longer accepting
detailees from USDS on their DOGE teams. See Am. Fed’n of Lab. & Cong. of Indus. Orgs. v.
Dep’t of Lab. (“AFL-CIO IV”), Civ. A. No. 25-339, 2025 WL 1129202, at *5–8 (D.D.C. Mar. 19,
2025). The Court reasoned that plaintiffs’ claims largely rest on whether DOGE affiliates are
agency employees with a need to access agency systems, such that the challenged record
disclosures fall within 5 U.S.C. § 552a(b)(1). See id. Whether the DOGE affiliates were direct
hires of the Agencies, detailees from other agencies, or detailees from USDS, that question
remained open. See id. So discovery into DOGE affiliates’ employment relationships was proper.
Id. at *8. No appeal of the Court’s discovery rulings was taken.
When discovery concluded, defendants moved to dismiss plaintiffs’ Amended Complaint.
See Defs.’ Mot. Dismiss [ECF No. 49]. The Court granted in part and denied in part defendants’
motion. As relevant here, the Court concluded that plaintiffs had adequately alleged
(1) associational standing to sue HHS and DOL; (2) claims under the APA that the Agencies’
DOGE data access policies were arbitrary and capricious, and inconsistent with the Privacy Act
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 10 of 48

11
and its implementing regulations; and (3) a claim that USDS acted ultra vires when accessing
sensitive systems at the Agencies. See Am. Fed’n of Lab. & Cong. of Indus. Orgs. v. Dep’t of
Lab. (“AFL-CIO V”), 778 F. Supp. 3d 56 (D.D.C. 2025).3
Plaintiffs then filed a motion for a preliminary injunction, seeking to enjoin DOL and HHS
from providing DOGE Affiliates access to their sensitive systems. Pls.’ Mot. Prelim. Inj. [ECF
No. 80]. The Court denied the motion, reasoning that while plaintiffs established that they had
standing to pursue a preliminary injunction, they had not shown they were likely to suffer
irreparable harm. Am. Fed’n of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO VI”),
Civ. A. No. 25-339, 2025 WL 1783899, *9, *15 (D.D.C. June 27, 2025).
The union plaintiffs—AFL-CIO, AFGE, AFSCME, SEIU, CWA, and AFT—now move
for summary judgment on their claims against HHS, DOL, and USDS.4 See Pls.’ Mot. They assert
that HHS and DOL adopted a policy of granting DOGE affiliates broad, unfettered access to
agency systems—systems that contain union members’ PII and PHI. See id. at 15–16. And they
charge that these DOGE data access policies violate the APA because they were adopted arbitrarily
and capriciously and are contrary to the Privacy Act and its implementing regulations. See id. at
18, 23. They further contend that USDS’s access to and use of the Agencies’ data is ultra vires,
see id. at 35, and request declaratory and injunctive relief to remedy their members’ injuries, see
id. at 36.
3 The Court dismissed plaintiffs’ free-standing Privacy Act claims (Count V), because only individuals—not
organizations—may sue under the Act. Id. at 88.
4 Concurrent with their motion for summary judgment, plaintiffs filed a stipulated notice of voluntary
dismissal of all claims against CFPB (Count III). See Dismissal Stipulation [ECF No. 92]. As a result, only union
plaintiffs remain in the case. The two nonprofit organizations that survived the defendants’ motion to dismiss—
Virginia Poverty Law Center and Economic Action Maryland Fund—had advanced claims only against CFPB. See
Pls.’ Mot. at 4 n.1.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 11 of 48

12
Defendants also move for summary judgment. They filed a cross-motion primarily arguing
that they never adopted the alleged DOGE data access policies and DOGE affiliates are employees
of the agencies where they work, so plaintiffs’ claims are both unreviewable and meritless. See
Defs.’ Mot. at 17, 23–38. They also contend that plaintiffs lack standing, see id. at 8–14, and that
the Privacy Act’s remedial scheme precludes consideration of APA claims founded on its
violation, see id. at 21–23.
The parties’ motions are ripe for decision.
LEGAL STANDARDS
Before turning to the many factual and legal issues raised in this case, the Court owes a
word about the proper standard of review.
III. Summary Judgment
Federal Rule of Civil Procedure 56 mandates the grant of summary judgment when “the
movant shows that there is no genuine dispute as to any material fact and the movant is entitled to
judgment as a matter of law.” Fed. R. Civ. P. 56(a). A fact is material if it might affect the outcome
of the suit under the governing law and in genuine dispute “if the evidence is such that a reasonable
jury could return a verdict for the nonmoving party.” Anderson v. Liberty Lobby, Inc., 477 U.S.
242, 248 (1986).
Upon cross-motions for summary judgment, courts consider each motion individually,
view the evidence in the light most favorable to the nonmovant, and determine whether the Rule
56 standard is met. Am. Ctr. for Int’l Lab. Solidarity v. Chavez-DeRemer, 789 F. Supp. 3d 66, 80
(D.D.C. 2025); see also Baylor v. Mitchell Rubenstein & Assocs., P.C., 857 F.3d 939, 952 (D.C.
Cir. 2017) (explaining that when the parties file cross-motions for summary judgment, courts
“must accord both parties the solicitude owed non-movants”). If genuine issues of material fact
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 12 of 48

13
exist, summary judgment may not be granted for either party. See, e.g., Sherwood v. Washington
Post, 871 F.2d 1144, 1146, 1148 (D.C. Cir. 1989); Doe 2 v. Mattis, 322 F. Supp. 3d 92, 94 (D.D.C.
2018). “It is of no moment” that the parties filed cross-motions for summary judgment or that they
asserted there were no genuine disputes about material facts. CEI Washington Bureau, Inc. v.
Dep’t of Just., 469 F.3d 126, 129 (D.C. Cir. 2006).
After denying a summary judgment motion due to the presence of disputed, material facts,
the court has broad discretion to provide the movant “an opportunity to properly support or address
the fact” or “issue any other appropriate order.” Fed. R. Civ. P. 56(e).5 Affording the parties an
opportunity to properly support or address the unsupported fact is generally courts’ “preferred first
step.” Fed. R. Civ. P. 56 advisory committee’s note to 2010 amendment; see, e.g., Am. Ctr. for
Int’l Lab. Solidarity, 789 F. Supp. 3d at 102 (granting defendants “another opportunity to submit
and support properly a motion for summary judgment” after denying the parties’ cross-motions).
IV. The APA Overlay
When evaluating the merits of an APA claim at summary judgment, the APA adds an
additional layer to the Court’s analysis—refining but not supplanting the Rule 56 standard.
Section 706(2)(A) of the APA instructs courts to review the administrative record and hold
unlawful and set aside agency actions, findings, or conclusions found to be “arbitrary, capricious,
an abuse of discretion, or otherwise not in accordance with law.” 5 U.S.C. § 706(2)(A). As a
practical matter, the merits of § 706 claims are almost always resolved by granting summary
5 When a movant properly supports her contention that a material fact is not in genuine dispute and the
nonmovant fails to respond with evidence to the contrary, Rule 56(e) supplies courts with two additional options:
(1) considering the fact undisputed for purposes of the motion, and (2) granting summary judgment, if the movant is
entitled to it. See Fed. R. Civ. P. 56(e)(2), (3). But as the D.C. Circuit explained in Winston & Strawn, LLP v.
McLean, courts may not “grant judgment ‘as conceded’ simply because a nonmoving party fails to respond. . . .
[J]udgment is granted only after the District Court satisfies itself that the record and any undisputed material facts
justify granting summary judgment.” 843 F.3d 503, 507 (D.C. Cir. 2016); see also Fed. R. Civ. P. 56 advisory
committee’s note to 1963 amendment (“Where the evidentiary matter in support of the motion does not establish the
absence of a genuine issue, summary judgment must be denied even if no opposing evidentiary matter is presented.”).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 13 of 48

14
judgment for one party or the other. This is because APA claims present a singular question—
whether, as a matter of law, the evidence in the administrative record permitted the agency to act
as it did. Drs. for Am. v. Off. of Pers. Mgmt., 793 F. Supp. 3d 112, 131 (D.D.C. 2025); see also
10B Wright & Miller, Federal Practice & Procedure § 2733 (4th ed.) (“Judicial review has the
function of determining whether the administrative action is consistent with law—that and no
more.” (quoting Louis L. Jaffe, Judicial Control of Administrative Action 595 (1965))).
Put differently, for the merits of APA claims, the defendant agency acts as factfinder by
means of the administrative record, “the district judge sits as an appellate tribunal,” and “the entire
case on review is a question of law.” Am. Biosci., Inc. v. Thompson, 269 F.3d 1077, 1084 (D.C.
Cir. 2001) (citation modified); see also James Madison Ltd. ex rel. Hecht v. Ludwig, 82 F.3d 1085,
1096 (D.C. Cir. 1996) (“Generally speaking, district courts reviewing agency action under the
APA’s arbitrary and capricious standard do not resolve factual issues, but operate instead as
appellate courts resolving legal questions.”).
Yet factual issues can forestall determination of whether an agency action was arbitrary,
capricious, an abuse of discretion, or otherwise contrary to law and therefore preclude entry of
summary judgment. “[T]he orderly functioning of the process of review requires that the grounds
upon which the administrative agency acted be clearly disclosed and adequately sustained.” Sec.
& Exch. Comm’n v. Chenery Corp., 318 U.S. 80, 94 (1943). Where an administrative record is
so scant or nonexistent “as to frustrate effective judicial review,” a court may defer decision on
the merits and “obtain from the agency, either through affidavits or testimony, such additional
explanation of the reasons for the agency decision as may prove necessary.” Camp v. Pitts, 411
U.S. 138, 142–43 (1973); see also Citizens to Pres. Overton Park, Inc. v. Volpe, 401 U.S. 402, 420
(1971).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 14 of 48

15
Alternatively, where an administrative record was compiled but is nevertheless insufficient
to assess the lawfulness of the challenged action, the court must “remand to the agency for
additional investigation or explanation.” Fla. Power & Light Co. v. Lorion, 470 U.S. 729, 744
(1985); see, e.g., Dep’t of Com. v. New York, 588 U.S. 752, 785 (2019) (remanding for further
explanation when the Agency’s offered rationale was “incongruent” with what the record showed
about its priorities). The court’s remand order may not, however, “dictate to the agency the
methods, procedures, and time dimension of the needed inquiry and order the results to be reported
to the court without opportunity for further consideration on the basis of the new evidence by the
agency.” Vt. Yankee Nuclear Power Corp. v. Nat. Res. Def. Council, Inc., 435 U.S. 519, 544–45
(1978) (citation modified).
ANALYSIS
I. 	Standing
The Court begins with its own jurisdiction to hear the case. To invoke the judicial power
of the federal courts, plaintiffs must have standing. California v. Texas, 593 U.S. 659, 668 (2021).
Standing requires that for each claim and form of relief sought, at least one plaintiff establishes
three “well-known and firmly rooted” elements: “(i) that she has suffered or likely will suffer an
injury in fact, (ii) that the injury likely was caused or will be caused by the defendant, and (iii) that
the injury likely would be redressed by the requested judicial relief.” Food & Drug Admin. v. All.
for Hippocratic Med., 602 U.S. 367, 380 (2024).
The manner of proof required to establish standing depends on the phase of the litigation.
TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021). At summary judgment, a plaintiff must
set forth specific facts, through affidavits or other evidence, demonstrating standing’s three
irreducible elements. Scenic Am., Inc. v. U.S. Dep’t of Transp., 836 F.3d 42, 48 (D.C. Cir. 2016);
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 15 of 48

16
Lujan v. Defs. of Wildlife, 504 U.S. 555, 561 (1992) (“[E]ach element must be supported in the
same way as any other matter . . . i.e., with the manner and degree of evidence required at the
successive stages of the litigation.”).
As organizations, the labor union plaintiffs have two mechanisms through which they may
establish standing. Elec. Priv. Info. Ctr. v. U.S. Dep’t of Com., 928 F.3d 95, 100 (D.C. Cir. 2019).
They may assert associational standing, which requires that (1) at least one of their members would
have standing to sue in their own right; (2) the interests the organizations seek to protect are
germane to the organizations’ purposes; and (3) neither the claims the organizations assert nor the
relief they request require their individual members to participate in the litigation. Int’l Dark-Sky
Ass’n, Inc. v. Fed. Commc’ns Comm’n, 106 F.4th 1206, 1217 (D.C. Cir. 2024). Otherwise, the
unions may assert that they have standing in their own right, often referred to as “organizational
standing.” Abigail All. for Better Access to Developmental Drugs v. Eschenbach, 469 F.3d 129,
132–33 (D.C. Cir. 2006). To do so they must show that they suffered an actual or threatened injury
to their activities that is fairly traceable to the alleged unlawful action and likely to be redressed
by a favorable court decision. Doc Soc’y v. Rubio, 141 F.4th 1273, 1276 (D.C. Cir. 2025).
In earlier stages of this litigation, this Court found that plaintiffs had adequately alleged
that their members suffered two injuries in fact—the disclosure of their private information by
HHS and DOL, and the unlawful consumption of this information by DOGE. See AFL-CIO V,
778 F. Supp. 3d at 69–73, 76; AFL-CIO VI, 2025 WL 1783899, at *3–7. No party disputed that
those alleged injuries were fairly traceable to the challenged actions of the defendants, redressable
through injunctive and declaratory relief, and germane to the unions’ mission of advancing their
members’ privacy. The parties also agreed that individual participation of union members is
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 16 of 48

17
unnecessary for plaintiffs’ APA claims, see AFL-CIO V, 778 F. Supp. 3d at 74, and the same logic
applies to their ultra vires claim.
Now, at summary judgment, AFL-CIO and its member unions, AFGE, AFSCME, SEIU,
CWA, and AFT, have supported these allegations with record evidence, making a sufficient
showing to establish that they have associational standing for each of their claims.6
A. Injury In Fact
The Court begins its analysis with the Article III standing element the parties most
vehemently contest: injury in fact. An injury in fact is “an invasion of a legally protected interest
that is concrete and particularized and actual or imminent, not conjectural or hypothetical.”
Spokeo, Inc. v. Robins, 578 U.S. 330, 339 (2016) (citation modified).
The harms plaintiffs assert satisfy all requirements. They are rooted in the particularized
interest each union member has in the privacy of his or her own PII and PHI, not some generalized
public interest.7 See id. (holding that injuries are “particularized” when they affect the plaintiff in
a personal, individual way). And the harms are “actual,” not speculative, because the Agencies
have already granted DOGE access to systems containing the PII and PHI of the unions’ members
6 Because the Court concludes that plaintiffs have associational standing, it does not reach their alternate
contention that they have organizational standing. See Pls.’ Mot. at 6.
7 Members of AFGE, AFSCME, SEIU, CWA, and AFT have filed declarations that they have private medical
information stored in HHS systems. See, Decl. of W. Wetmore [ECF No. 80-24] (declaration of AFGE member that
as a Medicare recipient, his data is stored in HHS’s Medicare systems); Decl. of D.M. Smith [ECF No. 80-23] (same
but for an AFSCME member); Decl. of I. Dahlgren [ECF No. 29-18] (same but for a SEIU member); Decl. of P.
Welsh [ECF No. 80-22] (same but for a CWA member); Decl. of D. Gray [ECF No. 80-25] (same but for an AFT
member).
Furthermore, AFGE has filed a declaration attesting that 5,000 of its members work at DOL and have their
personally identifiable information stored within its systems. See Decl. of R. Sanghvi [ECF 29-8] ¶¶ 4, 7. And
members of AFSCME, SEIU, CWA, and AFT have filed declarations that they have applied for unemployment
insurance, so DOL’s UIDRR system stores their PII. See Decl. of C. Sullivan [ECF No. 80-18] (AFSCME member
declaration); Decl. of N.D. Duckett [ECF No. 80-21] (SEIU member declaration); Decl. of J. Reese [ECF No. 80-20]
(CWA member declaration); Decl. of T. Fry [ECF No. 80-19] (AFT member declaration); see also Decl. of M.
Evermore [ECF No. 80-17] ¶¶ 5–7 (attesting that UIDRR contains PII of everyone who has applied for unemployment
insurance since March 2020).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 17 of 48

18
and DOGE affiliates have accessed those systems.8 See All. for Hippocratic Med., 602 U.S. at
381; Defs.’ Mot. at 10.
To be sure, standing to pursue injunctive relief requires more than evidence of a past injury.
Plaintiffs must also establish “a substantial risk of future injury.” Murthy v. Missouri, 603 U.S.
43, 69 (2024). That burden is met here. Courts test jurisdiction by examining the facts at the time
the suit was filed. Davis v. Fed. Election Comm’n, 554 U.S. 724, 734 (2008). And at the time
plaintiffs filed their complaint, DOGE access to the Agencies’ sensitive systems was imminent or
ongoing. See Decl. of R. J. Kryger; Decl. of G. Rice.9
The injuries plaintiffs assert are also “concrete.” An intangible injury is concrete when it
has “a ‘close relationship’ to a harm ‘traditionally’ recognized as providing a basis for a lawsuit in
American courts.” TransUnion, 594 U.S. at 424 (quoting Spokeo, 578 U.S. at 341). Such harms
“include, for example, reputational harms, disclosure of private information, and intrusion upon
seclusion.” Id. at 425. A common law analogue need not be an exact match for the harm the
plaintiff alleges, however. Congress may elevate the status of injuries that were previously
8 It is undisputed that HHS granted DOGE affiliates access to IDR and HIGLAS, sensitive systems containing
Medicare patient and provider data, and that DOGE affiliates actually accessed those systems. See Defs.’ Interrog.
Resp. at 7–9, 12, 15. It is also undisputed that DOL granted DOGE affiliates access to UIDRR and HRConnect,
sensitive systems containing union members’ unemployment insurance claims data and DOL employee data, and that
DOGE affiliates accessed those systems. See id. at 17–20.
9 To the extent the defendants contend that the court lacks jurisdiction because no DOGE affiliates remain at
DOL, see Defs.’ Mot. at 27, that is a mootness argument, not a standing argument, see Friends of the Earth v. Laidlaw
Env’t Servs., 528 U.S. 167, 190–94 (2000). An agency may not, however, “automatically moot a case by the simple
expedient of suspending its challenged conduct after it is sued.” FBI v. Fikre, 601 U.S. 234, 241 (2024) (internal
quotation marks omitted). To show mootness, defendants must prove that the challenged practice “cannot ‘reasonably
be expected to recur.’” Id. (quoting Friends of the Earth, 528 U.S. at 190); cf. City of Los Angeles v. Lyons, 461 U.S.
95, 109 (1983) (“cessation of the challenged conduct does not bar an injunction”).
Defendants offer no such assurances in this case, maintaining that their actions were and remain lawful. So
the absence of DOGE affiliates at DOL does not deprive the Court of jurisdiction to issue prospective relief. See Am.
Fed’n of Gov’t Emps. v. U.S. Off. of Pers. Mgmt., Civ. A. No. 25-1237, 2025 WL 3687548, at *7 (S.D.N.Y. Dec. 19,
2025) (finding a reasonable expectation of recurrence when “the executive orders that purportedly permitted OPM’s
broad and rushed grants of [data] access remain in place and OPM has still admitted no wrongdoing”).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 18 of 48

19
inadequate at law, and it may identify modern relatives of historical harms. See Pileggi v.
Washington Newspaper Publ’g Co., LLC, 146 F.4th 1219, 1226–27 (D.C. Cir. 2025); Gadelhak v.
AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (Barrett, J.). What matters is that the harm
alleged has “a ‘close relationship’ in kind, not degree,” with a harm recognized by common law.
Gadelhak, 950 F.3d at 462 (quoting Spokeo, 578 U.S. at 341); see also Pileggi, 146 F.4th at 1227.
(“So long as Congress alters the degree of harm and not the kind of harm, congressional action can
make an injury concrete.”).
The harms plaintiffs assert here bear a close relationship to the harms recognized in two
traditional common law torts: intrusion upon seclusion and breach of confidence. The tort of
intrusion upon seclusion makes liable any person “who intentionally intrudes, physically or
otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the
intrusion would be highly offensive to a reasonable person.” Restatement (Second) of Torts
§ 652B. This is precisely what plaintiffs allege occurred—DOGE affiliates intruded into the
sphere of privacy surrounding their members’ personal affairs and gained access to their private
information, including their social security numbers, bank account information, and medical
records. See Nemeth-Greenleaf v. U.S. Off. of Pers. Mgmt., Civ. A. No. 25-407, 2026 WL
607905, at *5 (D.D.C. Mar. 4, 2026) (“[DOGE’s] [u]nauthorized perusal of this data is the digital
equivalent of a stranger staring through a homeowner’s window to glean what she is doing or
rifling through another’s papers to gather information about his private life.” (citing Restatement
(Second) of Torts § 652B)).
Defendants insist that DOGE’s large-scale prying is different in kind, not just degree, from
the harm traditionally giving rise to the tort of intrusion upon seclusion. See Defs.’ Mot. at 13.
Quoting a recent Fourth Circuit decision, they argue that the tort “has long been understood to
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 19 of 48

20
guard not against disclosure of sensitive information as such” but instead the unease that stems
from “the knowledge that a third party is engaged in targeted snooping.” Id. (quoting Am. Fed’n
of Teachers v. Bessent (“AFT”), 152 F.4th 162, 175 (4th Cir. 2025)).
The Court respectfully takes a different view of the tort, as does every court in this circuit.
See All. for Retired Ams. v. Bessent, 770 F. Supp. 3d 79, 101–02 (D.D.C. 2025); New Mexico v.
Musk, 784 F. Supp. 3d 174, 195 (D.D.C. 2025); Ctr. for Taxpayer Rts. v. Internal Revenue Serv.,
Civ. A. No. 25-0457, 2025 WL 3251044, at *12–13 (D.D.C. Nov. 21, 2025); League of United
Latin Am. Citizens v. Exec. Off. of the President, Civ. A. No. 25-0946, 2026 WL 252420, at *51
(D.D.C. Jan. 30, 2026); Nemeth-Greenleaf, 2026 WL 607905, at *5.
The aptly named tort of intrusion upon seclusion is founded upon the discomfort produced
by intrusions into the secluded aspects of an individual’s life, including an individual’s home and
private affairs. Restatement (Second) of Torts § 652B. So what produces the injury it recognizes
is not targeting, as in malicious prosecution, but the knowledge that one’s private space or affairs
have been entered or exposed without consent. See Pearson v. Dodd, 410 F.2d 701, 704 (D.C. Cir.
1969) (agreeing that the tort extends to “instances of intrusion, whether by physical trespass or
not, into spheres from which an ordinary man in a plaintiff’s position could reasonably expect that
the particular defendant should be excluded”); Fox v. Dakkota Integrated Sys., LLC, 980 F.3d
1146, 1155 (7th Cir. 2020) (holding that a plaintiff’s claim that her workplace unlawfully retained
and shared her biometric data with a third-party database administrator was sufficiently analogous
to historical claims for invasion of privacy to establish injury in fact). The injury that plaintiffs
assert here, DOGE’s allegedly unauthorized intrusion into their members’ private data, stems from
that same harm. Declarations from the unions’ members confirm as much. They attest to the deep
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 20 of 48

21
unease and offense the union members feel at the thought of DOGE’s access to their data. See,
e.g., Decl. of D.M. Smith ¶ 9; Decl. of C. Sullivan ¶ 8.
The tort of breach of confidence supplies a second analogue. That tort “lies where a person
offers private information to a third party in confidence and the third party reveals that information
to another.” Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 (D.C. Cir. 2019) (internal
quotation marks omitted). The tort requires only that “the plaintiff’s trust in the breaching party
is violated.” Id. A trusted party’s disclosure to an unauthorized third party is sufficient. See id.
at 1064–65. Again, the unions allege that their members suffered exactly this harm. They aver
that their members entrusted HHS and DOL with their private data, assured by the Privacy Act’s
protections that the Agencies would not disclose it to others. See, e.g., Decl. of P. Welsh ¶ 4; Decl.
of N.D. Duckett ¶ 9. Then DOGE affiliates arrived, and the Agencies breached their confidence.
Defendants forgo any legal challenge to plaintiffs’ breach of confidence analogue. Instead,
they argue that the torts of breach of confidence and intrusion upon seclusion are factually
inapposite because plaintiffs’ members consented to HHS’s and DOL’s access to their data, and
DOGE affiliates are employees of the Agencies. See Defs.’ Mot. at 11. But defendants’ contention
mistakes standing for the merits. Whether DOGE affiliates were internal agency employees with
a need to access agency data—and were thus authorized to access that data under the Privacy Act—
is a merits question. To assess standing, the court must assume that plaintiffs will succeed on the
merits of their claims. Comm. on Judiciary of U.S. House of Representatives v. McGahn, 968
F.3d 755, 762 (D.C. Cir. 2020); LaRoque v. Holder, 650 F.3d 777, 785 (D.C. Cir. 2011).
Plaintiffs allege injuries in fact that are closely related to harms recognized by the common
law torts of intrusion upon seclusion and breach of confidence. And they have supported their
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 21 of 48

22
allegations with competent evidence, as is required at summary judgment. This is sufficient to
demonstrate that their members have suffered an injury in fact.
B. Other Elements of Associational Standing
With injury in fact established, four requirements for associational standing remain.
Plaintiffs carry their burden on all of them. There is no dispute that the injuries they allege are
traceable to the challenged conduct of the defendants, or that injunctive and declaratory relief
would redress the injuries. See Carpenters Indus. Council v. Zinke, 854 F.3d 1, 6 n.1 (D.C. Cir.
2017) (explaining that causation and redressability are two sides of the same coin: “if a government
action causes an injury, enjoining the action usually will redress that injury”).
The unions have also offered competent evidence that advancing their members’ privacy
rights is germane to their purposes. See Decl. of R. Sanghvi [ECF No. 29-8] (AFGE); Decl. of
K.C. Harrison [ECF No. 80-27] (AFSCME); Decl. of E.M. Neuman [ECF No. 80-39] (SEIU);
Decl. of A. van Schaick [ECF No. 80-28] (CWA); Decl. of D. McNeil [ECF No. 80-26] (AFT).
Finally, there is no reason to believe (and no party contends) that plaintiffs’ APA and ultra vires
claims require participation from individual union members.
The plaintiffs have thus established that they have associational standing. Assured of its
jurisdiction, the Court turns its attention to the merits.
II. 	APA Claims
Plaintiffs charge that the Agencies violated the APA by adopting DOGE data access
policies that are both arbitrary and capricious, and inconsistent with the Privacy Act of 1974 and
its implementing regulations.
Embedded within plaintiffs’ APA claims are allegations that the Agencies adopted two
distinct data policies: a policy of granting DOGE affiliates unfettered access to sensitive data,
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 22 of 48

23
regardless of their need or training, and a policy of classifying DOGE affiliates as internal agency
employees for data access purposes. See Pls.’ Mot. at 15. Plaintiffs’ arbitrary and capricious claim
targets only the former policy. It asserts that when the Agencies adopted the alleged policy, they
abandoned their training requirements and prior policy restricting sensitive data access to those
with a “need-to-know”—all without reasoned explanation. See id. at 16–18. Plaintiffs’ contrary-
to-law claim takes aim at both policies. That claim charges that the alleged policy of granting
DOGE affiliates access to sensitive data, regardless of need, and the concomitant classification of
DOGE affiliates as internal agency employees, violate the Privacy Act. See id. at 24.
A. Arbitrary and Capricious Claim
The APA “requires agencies to engage in reasoned decisionmaking, and directs that agency
actions be set aside if they are arbitrary or capricious.” Dep’t of Homeland Sec. v. Regents of the
Univ. of Cal., 591 U.S. 1, 16 (2020) (citation modified); see also 5 U.S.C. § 706(2)(A). An agency
action is arbitrary or capricious when the agency fails to consider the relevant data and
satisfactorily explain its action. Motor Vehicle Mfrs. Ass’n of U.S., Inc. v. State Farm Mut. Auto.
Ins. Co., 463 U.S. 29, 43 (1983). Because agencies must explain their actions, they may not
“depart from a prior policy sub silentio or simply disregard rules that are still on the books.” Fed.
Commc’ns Comm’n v. Fox Television Stations, Inc., 556 U.S. 502, 515 (2009). At minimum, an
agency must display awareness that it is changing position. Id.
The plaintiffs assert that precisely such a silent switch occurred at DOL and HHS, see Pls.’
Mot. at 19, while the Agencies protest that no policy change occurred, so plaintiffs’ claim is
unreviewable, see Defs.’ Mot. at 18–20, 23. The Court begins and ends its analysis of plaintiffs’
arbitrary and capricious claim with this threshold question of reviewability because it finds that a
genuine issue of material fact precludes entry of summary judgment for either party.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 23 of 48

24
i. APA Reviewability: Final Agency Action
Section 702 of the APA supplies a cause of action to those suffering a legal wrong because
of “agency action.” See 5 U.S.C. § 702. Courts have long understood that “agency action” is a
purposefully broad term, “meant to cover comprehensively every manner in which an agency may
exercise its power.” Whitman v. Am. Trucking Ass’ns, 531 U.S. 457, 478 (2001); see also 5
U.S.C. § 551(13) (defining “agency action” to include “the whole or a part of an agency rule, order,
license, sanction, relief, or the equivalent or denial thereof, or failure to act”). Yet the range of
agency conduct reviewable as “agency action” is not limitless. To invoke the APA, plaintiffs must
identify “discrete” or “particular” actions the agency took. Norton v. S. Utah Wilderness All.
(“SUWA”), 542 U.S. 55, 64 (2004) (quoting Lujan, 497 U.S. at 891). Wholesale objections to an
agency’s operations do not suffice because they fail to clearly define the scope of the controversy
and raise grievances resolvable only by Congress. Lujan, 497 U.S. at 891; see also SUWA, 542
U.S. at 64 (“The limitation to discrete agency action precludes . . . broad programmatic attack[s].”)
Section 704 of the APA further limits the scope of agency actions subject to judicial review.
Corner Post, Inc. v. Bd. of Governors of Fed. Rsrv. Sys., 603 U.S. 799, 808 (2024). That provision
establishes that plaintiffs may only challenge “final” agency actions, unless another statute
authorizes judicial review of interlocutory acts. See 5 U.S.C. § 704. Agency action is “final”
when the action marks “the consummation of the agency’s decisionmaking process,” and either
“rights or obligations have been determined,” or “legal consequences will flow” from the agency’s
action. U.S. Army Corps of Eng’rs v. Hawkes Co., 578 U.S. 590, 597 (2016) (quoting Bennett v.
Spear, 520 U.S. 154, 178 (1997)).
It bears emphasizing that the parties do not dispute that the adoption and implementation
of a data access policy that determines the data privacy rights of millions of Americans, including
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 24 of 48

25
members of the plaintiff unions, would constitute final agency action. Nor could they. See, e.g.,
Venetian Casino Resort, L.L.C. v. E.E.O.C., 530 F.3d 925, 931 (D.C. Cir. 2008). Specific, final
agency actions that “apply[] some particular measure across the board” to many individual agency
decisions “can of course be challenged under the APA by a person adversely affected.” Lujan,
497 U.S. at 890 n.2. The parties instead dispute whether the alleged DOGE data policy was ever
adopted and implemented, such that plaintiffs’ claim targets “final agency action” and the APA
supplies them with a cause of action. See Defs.’ Mot. at 18–19; Pls.’ Mot. at 15–17.
In other words, whether the Agencies adopted the alleged DOGE data access policy is a
material fact and the Court’s first task is to determine on the record provided whether it is
genuinely disputed.
ii. Plaintiffs’ Motion for Summary Judgment
The Court begins with plaintiffs’ motion for summary judgment because they shoulder the
burden of proof. See Lujan, 497 U.S. at 884. As the Court evaluates plaintiffs’ motion, it draws
all reasonable inferences in the nonmovant Agencies’ favor and grants summary judgment only if
the record reveals no genuine issue of material fact. Anderson, 477 U.S. at 255.
Plaintiffs marshal five categories of evidence to demonstrate that the Agencies abandoned
their prior policies in favor of granting DOGE affiliates broad, unfettered access to sensitive
agency systems. These categories include:
 Evidence that the Agencies repeatedly granted DOGE affiliates access to a wide
array of sensitive systems, with 10 DOGE affiliates at HHS gaining access to 19
unique systems (55 total access grants), and 3 DOGE affiliates at DOL gaining
access to 8 unique systems (14 total access grants). See HHS 30(b)(6) Dep.
(Wendel) Chart; Defs.’ Interrog. Resp. at 17–20.
 Evidence that the scope of the DOGE data access grants was unusual, at least at
HHS. See HHS 30(b)(6) (Wendel) Dep. [ECF No. 82-4] at 41–42 (testifying that
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 25 of 48

26
HHS’s CIO was unaware of another role at the Agency requiring as broad of system
access as the DOGE affiliates).
 Evidence that HHS and DOL leadership did not routinely confirm that DOGE
affiliates needed access to a sensitive system before granting their access requests.
For example, DOL’s CIO testified that the Agency did not ask DOGE affiliates the
questions typically asked before granting employees sensitive data access,
including “why is the access needed” and “what will the access be used for.” DOL
30(b)(6) Dep. at 75–76. HHS’s CIO similarly testified that the Agency did not
conduct “individualized review” of DOGE affiliates’ need to know specific data.
HHS 30(b)(6) (Wendel) Dep. at 31.
 Evidence that neither HHS nor DOL ever rejected a DOGE affiliate’s access
request because the affiliate lacked a need to know the data. See id. at 36–37, 40
(testifying that HHS had not denied any DOGE data access requests and “did not
know” of any rationale that would justify denying a DOGE affiliate’s access
request); DOL 30(b)(6) Dep. at 87–88 (testifying that DOL rejected two DOGE
data access requests—one due to ongoing litigation, and one because read-only
system access was unavailable).
 Evidence that a DOGE affiliate at HHS received access to systems containing
highly sensitive Medicare data for millions of Americans without completing
customary security training. See Decl. of J. Wendel [ECF No. 82-1] ¶ 9.
The Agencies attack plaintiffs’ motion on three fronts.
To begin, they protest that the kinds of evidence plaintiffs cite cannot support an inference
that HHS and DOL adopted the alleged DOGE data access policies. The Agencies contend that
courts may not infer the adoption of a final policy unless the alleged policy is long-running,
agency-wide, conceded to exist, and expressly written down. See Defs.’ Mot. at 18 (citing AFT,
152 F.4th at 175). So because plaintiffs have not produced evidence that the Agencies formalized
the alleged data access policies in writing and admitted to adopting them, or that the alleged
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 26 of 48

27
policies were time-honored and applied to all agency employees, the Agencies insist that plaintiffs’
summary judgment motion must fail. Id. at 18–19. The Court respectfully disagrees with the
Agencies’ statement of the law.
Agency action is no less final because it is new, see, e.g., Dep’t of Homeland Sec., 591
U.S. at 13 (DACA rescission challenged “[w]ithin days” was final agency action), or affects only
a portion of the Agency’s duties. Nor must an agency concede the challenged policy exists or
formalize it in writing. See, e.g., Bhd. of Locomotive Eng’rs v. Fed. R.R. Admin., 972 F.3d 83,
100 (D.C. Cir. 2020) (“Agency action generally need not be committed to writing to be final and
judicially reviewable.”); Hisp. Affs. Project v. Acosta, 901 F.3d 378, 386 (D.C. Cir. 2018) (holding
that agency practice can demonstrate the adoption of an unwritten, but nevertheless final policy).
To hold otherwise would allow agencies to immunize unlawful acts by refusing to document them
or denying that they took them. Frustration of the APA cannot be that easy. See Camp, 411 U.S.
at 142–43.
Alternatively, the Agencies contend that even if the court could infer adoption of a final
policy from the types of evidence plaintiffs have presented, here the record reveals only a handful
of scattered, individual actions which plaintiffs may not programmatically challenge. See Defs.’
Mot. at 20; SUWA, 542 U.S. at 64. After careful examination of the evidence, the Court declines
to endorse defendants’ view of the record.
Plaintiffs have come forward with evidence of nearly 70 instances in which HHS and DOL
granted wide-ranging data access to DOGE affiliates—a far cry from a single, or even a handful,
of agency acts insufficient to support the inference of a final policy. And while these grants pertain
to a variety of systems at two agencies, plaintiffs cite general statements from agency leadership
that they granted DOGE affiliates access to sensitive systems without asking why those affiliates
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 27 of 48

28
needed the access. So a reasonable jury could infer from the Agencies’ own testimony that an
overarching policy guided each of the access grants: a new policy of permitting DOGE affiliates
access to sensitive systems, regardless of demonstrated need to know the data the systems contain.
Cf. Nat’l Treasury Emps. Union v. Vought, 149 F.4th 762, 804–20 (D.C. Cir. 2025) (Pillard, J.,
dissenting) (inferring that the Administration had adopted a final policy of shuttering the CFPB
from the many actions it took to wind down the agency’s operations), reh’g en banc granted,
opinion vacated, No. 25-5091, 2025 WL 3659406 (D.C. Cir. Dec. 17, 2025).
The same cannot be said for plaintiffs’ allegation that the Agencies adopted a policy of
permitting DOGE affiliates to gain access to sensitive systems without first completing required
training. The Agencies are correct that a single DOGE employee electing not to complete an
optional security briefing for one system cannot support the inference that the Agencies altered
their training requirements for DOGE. So the Court agrees with the Agencies that plaintiffs’
motion fails on this point.
Lastly, the Agencies challenge plaintiffs’ summary judgment motion by advancing their
own view of the facts. See Fed. R. Civ. P. 56(c)(1)(A). They underscore statements from Agency
leadership denying the existence of DOGE-specific data access policies. See Defs.’ Mot. at 20;
HHS 30(b)(6) Dep. (Wendel) at 37 (testifying that HHS has not altered “its practices about
providing access to records since January 19th, 2025”); DOL 30(b)(6) Dep. at 89–90 (stating that
DOGE access requests are treated “with more urgency,” but otherwise “the policy is . . . the
same”). And they cite evidence that President Trump’s executive orders—not a change in agency
policy—explain both the broad data access granted to DOGE affiliates and the Agencies’ choice
not to ask those affiliates why they needed access. Defs.’ Mot. at 20; see, HHS 30(b)(6) Dep.
(Wendel) at 29–31, 38 (DOGE affiliates were granted access to 19 unique systems because of the
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 28 of 48

29
broad job responsibilities assigned to them by DOGE executive orders); DOL 30(b)(6) Dep. at 75–
76 (DOL did not ask DOGE affiliates why they needed to access various sensitive systems because
their need was “apparent” from “their role and responsibilities outlined in the [executive orders]”).
The Agencies’ last contention has decisive force. If the executive orders vested DOGE
affiliates with the need to access a broad range of sensitive systems, Agency employees became
aware of this need by reading the orders, and DOGE team members were granted sensitive system
access because of the orders, then plaintiffs’ evidence would not establish that the Agencies
eliminated their need-to-know data access policies for DOGE.
To be sure, the Agencies’ blanket citation to the executive orders leaves many unanswered
questions—questions that the Court discusses at length when considering the Agencies’ motion
for summary judgment. See infra 30–35. But when evaluating plaintiffs’ motion for summary
judgment, the Court must draw all reasonable inferences in favor of the Agencies. Faithfully
applying this directive, the Court concludes that a reasonable jury could credit the Agencies’
evidence that the arrival of DOGE did not herald a change in their data access policies, only the
application of existing policies to new circumstances. The plaintiffs have therefore failed to
establish that there is no genuine dispute as to a material fact: whether the Agencies took the final
action plaintiffs contend was arbitrary and capricious. So the Court denies plaintiffs’ motion for
summary judgment on their arbitrary and capricious claim.
iii. Agencies’ Motion for Summary Judgment
Turning to the Agencies’ motion for summary judgment, the Court shifts and draws all
reasonable inferences in plaintiffs’ favor. See Anderson, 477 U.S. at 255.
The Agencies raise the same arguments in support of their motion for summary judgment
as they do in opposition to the plaintiffs’. To wit, HHS and DOL contend that there is no genuine
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 29 of 48

30
dispute that they applied their preexisting policies to DOGE affiliates’ data access requests. See
Defs.’ Mot. at 19–20. And without a change in policy, plaintiffs’ claim does not challenge final
agency action and may not proceed under the APA. Id. at 16–17.
The Agencies support their view of the facts with deposition testimony from their CIOs
that no data access policies changed upon the arrival of DOGE and that their data access policies
apply equally to DOGE affiliates and non-DOGE employees. See HHS 30(b)(6) Dep. (Wendel)
at 38–39; DOL 30(b)(6) Dep. at 89–90. To rebut plaintiffs’ evidence that DOGE affiliates’
sensitive system access was unusually broad, the Agencies point to the affiliates’ wide range of
responsibilities under the executive orders. See, e.g., HHS 30(b)(6) Dep. (Wendel) at 29, 38–39
(testifying that DOGE affiliates were granted sensitive system access because of the executive
orders and this access was broad because the affiliates were “brought in to look across HHS”);
DOL 30(b)(6) Dep. at 78–79 (testifying that the January 20 Executive Order established DOGE
affiliates’ roles and responsibilities, making their data access needs “clear and apparent”).
The Agencies also rely on the executive orders to explain why HHS and DOL did not
always ask DOGE affiliates why they needed access to a particular system. According to the
Agencies, such inquiries were unnecessary because they could infer affiliates’ need to access
sensitive systems from their roles and responsibilities, as laid out in the executive orders. See
Defs.’ Reply [ECF No. 99] at 8; DOL 30(b)(6) Dep. at 76–79; HHS 30(b)(6) Dep. (Wendel) at 33.
Close examination of the Agencies’ executive order-based explanation raises substantial
doubts about its veracity. Begin with HHS. On January 29, 2025, HHS granted Farritor access to
HCAS, a contract writing system. Defs.’ Interrog. Resp. at 7; HHS 30(b)(6) Dep. (Wendel) Chart
at 2. When asked why Farritor required access to HCAS, HHS’s CIO testified: “He needed access
because under the executive order HHS was required to look at systems for waste, fraud and
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 30 of 48

31
abuse. . . .” HHS 30(b)(6) Dep. (Wendel) at 27. But HHS has not pointed to an executive order
in place on January 29, 2025, that charged DOGE affiliates with rooting out waste, fraud, and
abuse. In the Agencies’ own telling, President Trump first issued such an order on February 26,
2025, nearly a month after HHS granted Farritor access to HCAS. See Defs.’ Mot. at 3–4; compare
January 20 Executive Order with, February 26 Executive Order.
Farritor’s access to HCAS is not an isolated case. HHS granted DOGE affiliates access to
13 sensitive systems before President Trump issued the February 26 Executive Order vesting the
affiliates with waste, fraud, and abuse responsibilities. See Defs.’ Interrog. Resp. at 7, 16. Yet
HHS has repeatedly stated that its DOGE affiliates needed access—even before February 26—to
the Agency’s sensitive systems to carry out DOGE executive orders targeting waste, fraud, and
abuse. See HHS 30(b)(6) Dep. (Wendel) at 32–33; Decl. of G. Rice ¶ 6; Defs.’ Interrog. Resp. at
6–16.
Access grants made after the promulgation of the February 26 Executive Order raise
questions, too. Recall that the February 26 Executive Order directed agency heads and DOGE
affiliates to review “all existing covered contracts and grants.” February 26 Executive Order
§ 3(b). The Order defined covered contracts and grants as “discretionary spending through Federal
contracts, grants, loans, and related instruments” but not “direct assistance to individuals;
expenditures related to immigration enforcement, law enforcement, the military, public safety, and
the intelligence community; and other critical, acute, or emergency spending.” Id. § 2(d). DOGE
affiliates were not vested with broader waste, fraud, and abuse responsibilities until President
Trump issued the March 20, 2025, executive order. See March 20 Executive Order.
But between the February and March executive orders, HHS granted DOGE affiliates
access to several sensitive systems that do not, on their face, appear to contain data concerning
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 31 of 48

32
discretionary grant spending. Most troublingly, during the first two weeks of March, HHS granted
Corristine, Elez, Moghaddassi, and Terrell access to HHS’s Integrated Data Repository (IDR).
Defs.’ Interrog. Resp. at 8–9, 12, 15. IDR contains highly sensitive information about Medicare
patients and their claims, including patient names, social security numbers, diagnoses, and clinical
notes. HHS 30(b)(6) Dep. (Wendel) Chart at 1. Based on the record presented by HHS thus far,
IDR does not appear to contain the kind of discretionary spending data that the February 26
Executive Order directed DOGE affiliates to audit. The Court is therefore puzzled by how this
Order could have made DOGE affiliates’ need to access IDR apparent to HHS.
HHS also granted Moghaddassi and Elez access to the National Directory of New Hires
(NDNH) during the period between promulgation of the February 26 and March 20 Executive
Orders. See Defs.’ Interrog. Resp. at 9, 12. When asked about their access to NDNH, HHS
testified that because the system documents child support, Moghaddassi and Elez were
investigating it as “an entitlement system . . . to see if it potentially would be a system that had
waste, fraud and abuse.” HHS 30(b)(6) Dep. (Wendel) at 43–44. Yet entitlement spending, by
definition, is not discretionary grant spending, so it is unclear how the February 26 Executive
Order could have authorized DOGE affiliates to audit NDNH.
Even after President Trump issued the March 20 Executive Order, HHS’s executive order-
based explanation for its DOGE access decisions proves difficult to fully accept. That Order vested
DOGE affiliates with a need to access sensitive agency systems to audit them for fraud, waste, and
abuse. It did not give affiliates carte blanche to access them for other reasons. See Chenery Corp.,
318 U.S. at 93–94 (Agency “action must be measured by what the [Agency] did, not by what it
might have done.”).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 32 of 48

33
On March 21, 2025, HHS granted Kyle Shutt access to its Unaccompanied Children Portal.
Defs.’ Interrog. Resp. at 10. Maintained by the Office of Refugee Resettlement, the Portal contains
highly sensitive demographic and health data about unaccompanied alien children, including
photographs of the children. HHS 30(b)(6) Dep. (Wendel) Chart at 4. It also contains citizenship
and financial data about the children’s sponsors. Id.
HHS testified that Shutt needed access to the Portal “to make the determination [whether]
the system had any indication of waste, fraud or abuse.” HHS 30(b)(6) (Wendel) Dep. at 47.
When pressed on what evidence of waste, fraud, or abuse the Unaccompanied Children Portal
could contain, the Agency referenced “employment information and sponsor information,”
specifically “looking to see if the payments to the sponsors were legal and legitimate.” Id. at 48.
But as ORR’s Sponsor Handbook makes clear, sponsors—not the government—are responsible
for supporting unaccompanied alien children after they leave ORR custody. See ORR, Sponsor
Handbook 13 (revised Mar. 25, 2024), https://perma.cc/9JAN-QU29; see also Decl. of John Doe
[ECF No. 83-4] ¶ 11 (denying knowledge of payments to sponsors or documentation of those
payments in the Portal); HHS, Privacy Impact Assessment for the Unaccompanied Children Portal
3–5 (May 22, 2024) (listing many data elements contained within the Portal, but not sponsor
payment data), https://perma.cc/E8MK-TYEK. So it remains unclear at this stage whether the
DOGE executive orders could supply affiliates with a need to access the Portal.10
Timing problems also cast doubt on DOL’s testimony that the DOGE executive orders
explain why it did not ask affiliates why they needed access to various sensitive systems before
10 The Court takes judicial notice that four days after HHS granted Shutt access to the Unaccompanied
Children Portal, the Administration published an Interim Final Rule in the Federal Register revoking a prior rule that
precluded ORR from sharing information about the immigration status of potential sponsors of unaccompanied alien
children with law enforcement or immigration enforcement. Unaccompanied Children Program Foundational Rule;
Update to Accord with Statutory Requirements, 90 Fed. Reg. 13554 (Mar. 25, 2026). See 44 U.S.C. § 1507 (“The
contents of the Federal Register shall be judicially noticed . . . .”) The Portal contains this information. See HHS,
Privacy Impact Assessment for the Unaccompanied Children Portal 3–5 (May 22, 2024).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 33 of 48

34
granting that access. See DOL 30(b)(6) Dep. at 75–76. For example, on February 20, 2025, DOL
granted Moghaddasi and Collins access to DOL’s New Core Financial Management System
(NCFMS). Defs.’ Interrog. Resp. at 18–20. At its 30(b)(6) deposition, DOL explained that
Moghaddassi and Collins needed this access to look for “the broad categories of fraud, waste and
abuse.” DOL 30(b)(6) Dep. at 126–27. But as of February 20, 2025, the February 26 Executive
Order directing affiliates to review discretionary spending for fraud, waste, and abuse had not yet
been issued. DOL further testified that Moghaddassi and Elez began reviewing DOL data for
fraud, waste, and abuse on January 19, 2025, and February 12, 2025, respectively. Id. at 20–21,
34. These dates, too, precede the first executive order assigning fraud, waste, and abuse
responsibilities to DOGE affiliates.
And just like HHS, DOL granted DOGE affiliates access to several sensitive systems after
the February 26 Executive Order but before the March 20 Executive Order that do not appear to
contain discretionary grant spending data and cannot be easily justified by the February 26
Executive Order. At DOL these systems included: USAccess, Homeland Security Presidential
Directive 12 Enterprise Physical Access Control System, and DOL Directory Resource
Administrator—all three of which appear to pertain to physical and electronic access to DOL’s
facilities and assets by its employees. See Defs.’ Interrog. Resp. at 18–19.
In short, the Agencies’ explanation for their actions is incompatible with a substantial
portion of the record on review. And courts may not ignore such a disconnect between the
explanation an agency gives and the action it takes. Dep’t of Com., 588 U.S. at 785. To do so
would “exhibit a naiveté from which ordinary citizens are free.” Id. (quoting United States v.
Stanchich, 550 F.2d 1294, 1300 (2d Cir. 1977) (Friendly, J.)). It would also deny plaintiffs the
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 34 of 48

35
“solicitude” they are owed upon consideration of the Agencies’ motion for summary judgment.
Baylor, 857 F.3d at 952.
Considering these gaps in the Agencies’ explanation and drawing all justifiable inferences
in favor of plaintiffs, the Court finds that a reasonable jury could reject the Agencies’ executive
order-based explanation for the broad and unquestioning nature of their DOGE data access grants.
The jury could then infer from plaintiffs’ evidence that the Agencies abandoned their need-to-
know data access policies without reasoned explanation. Thus, the Court must deny the Agencies’
motion for summary judgment.
This is not to say that plaintiffs have proven that the Agencies adopted the alleged DOGE
data access policies. As the Court concluded in denying plaintiffs’ motion for summary judgment,
a reasonable jury could also believe the Agencies’ denials of policy change. Now that the Court
has more thoroughly examined the Agencies’ explanation for their actions, it owes a further word
on this point.
Granting summary judgment for plaintiffs would be improper at this juncture because at
least one possible explanation for the discrepancies highlighted here lurks in the record. In their
interrogatory responses, the Agencies state that software modernization duties also justified DOGE
affiliates’ access to agency systems. See Defs.’ Interrog. Resp. at 6–20. And the Agencies’
summary judgment briefing makes a similar argument, albeit obliquely. See Defs.’ Mot. at 30,
33; Defs.’ Reply at 12, 15. But to date, the Agencies have not come forward with any evidence to
support this assertion. They have not offered evidence that the sensitive systems DOGE affiliates
accessed were scoped for software modernization projects, that DOGE affiliates were staffed to
work on those projects, or that Agency employees granted the affiliates access because of their
involvement in those projects. The most likely explanation is that none of that happened.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 35 of 48

36
Nevertheless, it remains possible that the Agencies could produce such evidence. And depending
on its provenance and persuasiveness, such evidence could dispel the temporal discrepancies the
Court has identified because all access grants at issue here postdate the January 20 Executive Order
directing DOGE affiliates to modernize government software.11
* 	* 	* 	* 	*
The Court therefore holds that a genuine issue of material fact exists as to whether the
Agencies altered their data access policies for DOGE affiliates and denies both the plaintiffs’ and
the Agencies’ motions for summary judgment. As is best practice upon denial of cross-motions
for summary judgment, the Court will provide the parties with an opportunity to properly support
or address the genuinely disputed fact it has identified: whether the executive orders justify the
Agencies’ data access grants under longstanding policy, refuting the existence of new DOGE data
access policies. See Fed. R. Civ. P. 56(e).
B. Contrary-to-Law Claim
Plaintiffs raise a second APA challenge: that the Agencies’ policy of classifying DOGE
affiliates as agency employees and granting them access to sensitive systems without the requisite
need-to-know violates the Privacy Act and is therefore contrary to law. See 5 U.S.C. § 706(2); 5
U.S.C. § 552a(b)(1). Here, at least, the parties agree that a policy of classifying DOGE affiliates
as agency employees exists.12 See Defs.’ Mot. at 5–6 (describing DOGE affiliates’ access requests
11 The Agencies might also explain some of their access grants by pointing to a fourth executive order, issued
on February 11, 2025. See Exec. Order No. 14,210, 90 Fed. Reg. 9669 (Feb. 11, 2025). This executive order directed
DOGE team leads to provide USDS with a monthly hiring report from their agencies and develop “data-driven” hiring
plans at their agencies. Id. § 3(b). It also enabled DOGE team leads to veto agency new hires, subject to review by
their agency head. Id. While DOL’s CIO referenced the February 11 Executive Order in his deposition, see DOL
30(b)(6) Dep. at 127 (mentioning the “other” executive order about the hiring freeze), no party has cited the Order in
their briefing, so the Court does not rely on it today.
12 The Agencies dispute, of course, that they adopted a policy of allowing DOGE affiliates access to
sensitive systems without a requisite need-to-know. See supra 28–29.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 36 of 48

37
as “like any employee’s request”); Defs.’ Reply at 1–2 (describing DOGE affiliates as equivalent
to “any other employee” for IT credentialing purposes).
The Agencies nevertheless assert that plaintiffs’ contrary-to-law claim is not reviewable
under the APA, because the Privacy Act supplies an exclusive remedial scheme. See Defs.’ Mot.
at 21. Their contention is well-trodden ground; the Agencies unsuccessfully pressed the same
argument in their earlier motion to dismiss. But because additional courts have weighed in since,
the Court considers the question afresh.
i. APA Reviewability: Alternative Remedial Scheme
Section 704 of the APA makes “final agency action for which there is no other adequate
remedy in a court” reviewable under the Act. 5 U.S.C. § 704. Where alternative, adequate
remedial procedures exist, the APA does not duplicate them. Bowen v. Massachusetts, 487 U.S.
879, 903 (1988); see also Hawkes Co., 578 U.S. at 600.
To determine whether a separate statute displaces APA review, courts assess whether
“congressional intent to preclude judicial review is ‘fairly discernible in the statutory scheme.’”
Block v. Cmty. Nutrition Inst., 467 U.S. 340, 351 (1984) (quoting Ass’n of Data Processing Serv.
Orgs., Inc. v. Camp, 397 U.S. 150, 157 (1970)).13 Relevant factors for this assessment include
whether the statute: (1) creates an independent cause of action or alternative review procedure, and
(2) provides relief of “the same genre” as the APA, even if not identical or as effective, or
(3) establishes a remedial scheme that is “incompatible” with APA review “in major respects.”
13 The D.C. Circuit has described the “fairly discernible” standard as requiring “clear and convincing
evidence” of legislative intent to restrict APA review. Garcia v. Vilsack, 563 F.3d 519, 523 (D.C. Cir. 2009) (quoting
Abbott Laby’s v. Gardner, 387 U.S. 136, 140 (1967))); see also Citizens for Resp. & Ethics in Wash. v. Dep’t of Just.,
846 F.3d 1235, 1244 (D.C. Cir. 2017). But some debate exists on this point. The Circuit recently observed that the
Supreme Court “has ‘never applied the ‘clear and convincing evidence’ standard in [a] strict evidentiary sense.’”
Glob. Health Council v. Trump, 153 F.4th 1, 18 (D.C. Cir. 2025) (quoting Block, 467 U.S. at 350).
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 37 of 48

38
V.I. Hous. Fin. Auth. v. Fed. Emergency Mgmt. Agency, 151 F.4th 409, 418 (D.C. Cir. 2025)
(citation modified). At bottom, Congress’s judgment is what matters. Id.
The Privacy Act supplies plaintiffs with two types of remedies—monetary damages for
harm caused by an agency’s failure to comply with the Act, and injunctive relief ordering either
the amendment of records or the disclosure of records an agency has improperly withheld. See 5
U.S.C. § 552a(g)(1)–(4); Cell Assocs., Inc. v. Nat’l Insts. of Health, Dep’t of Health, Educ. &
Welfare, 579 F.2d 1155, 1159 (9th Cir. 1978). The Act is silent as to an equitable cause of action
for relief from imminent, unlawful disclosure of records. It does not create one and it does not
expressly preclude one.
This Court finds nothing in the Privacy Act’s text or the structure of its remedial scheme
that evinces fairly discernable congressional intent to displace the APA’s “basic presumption of
judicial review.” Abbott Laby’s v. Gardner, 387 U.S. 136, 140 (1967). The Act does not expressly
bar claims for injunctive relief, nor does it channel them to a dedicated administrative body,
rendering its scheme incompatible with APA review. See Jackson v. Kennedy, Civ. A. No. 25-
1750, 2026 WL 172440, at *3 (D.D.C. Jan. 22, 2026) (explaining that plaintiffs cannot bring
Privacy Act claims in any administrative tribunal).
True, the Privacy Act enables persons adversely affected by an unlawful disclosure of their
records to seek damages. But damages are not in the same “genre” as equitable remedies, like
injunctive and declaratory relief. Cf. Cohen v. United States, 650 F.3d 717, 734 (D.C. Cir. 2011)
(en banc) (holding that the availability of tax refunds did not preclude plaintiffs from seeking
injunctive and declaratory relief under the APA from an IRS notice). And on the crucial question
here—the availability of equitable relief to prevent imminent and unlawful disclosures—the
Privacy Act is silent. In that silence the Court sees ambiguity, not certainty. Cf. Barnhart v.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 38 of 48

39
Walton, 535 U.S. 212, 218 (2002) (observing that statutory silence “normally creates ambiguity.
It does not resolve it.”).
Precedent from this Circuit and the Supreme Court bolster the Court’s conclusion that the
Privacy Act’s remedial scheme does not preclude APA review of plaintiffs’ claim. In Doe v.
Stephens, the D.C. Circuit determined that the availability of a damages remedy under the Privacy
Act did not bar the plaintiff from seeking declaratory relief under the APA. 851 F.2d 1457, 1463
(D.C. Cir. 1988); see also League of United Latin Am. Citizens, 2026 WL 252420 at *52 (holding
that the Privacy Act’s damages remedy did not preclude plaintiffs from seeking declaratory and
injunctive relief under the APA). The Supreme Court, too, has commented in dicta that the Privacy
Act’s silence with respect to equitable relief may be “explained by the general provisions for
equitable relief within the Administrative Procedure Act,” although it has not expressly ruled on
the question. Doe v. Chao, 540 U.S. 614, 619 n.1 (2004); see also F.A.A. v. Cooper, 566 U.S.
284, 303 n.12 (2012) (commenting that injunctive relief to enforce the Privacy Act’s commands
is “possibly” available under the APA).
The Fourth Circuit’s decision in AFT does not persuade the Court otherwise. The AFT
majority found only that the Privacy Act’s remedial scheme, including its “enumerated violations
and details on jurisdiction, venue, and timing” could “at least plausibly” evince congressional
intent to preclude APA claims seeking an injunction against disclosures in violation of the Act.
AFT, 152 F.4th at 175. Based on this finding and others, the Fourth Circuit denied the AFT
plaintiffs’ motion for a preliminary injunction. Id. at 177. But mere plausibility is insufficient to
displace the “strong presumption” in favor of judicial review of administrative action. Bowen v.
Mich. Acad. of Fam. Physicians, 476 U.S. 667, 670 (1986). Fairly discernable congressional intent
is required. Block, 467 U.S. at 351. Neither the Agencies nor the Fourth Circuit point to any.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 39 of 48

40
When denying the Agencies’ motion to dismiss, this Court found that the APA could step
into the breach and supply plaintiffs with a cause of action for injunctive and declaratory relief.
AFL-CIO V, 778 F. Supp. 3d at 80. On second look, the Court reaffirms that conclusion. The
Privacy Act does not preclude plaintiffs’ APA claim that the alleged DOGE data access policies
are contrary to law.14
ii. Merits
Turning to the merits of plaintiffs’ contrary-to-law claim, the Court’s task is deceptively
simple. Section 706 of the APA requires that agency actions “not in accordance with law” be held
unlawful and set aside. 5 U.S.C. § 706(2). So the Court must determine, as a matter of law,
whether evidence in the administrative record permitted the agencies to act as they did. Drs. for
Am., 793 F. Supp. 3d at 131; see also Loper Bright Enters. v. Raimondo, 603 U.S. 369, 392 (2024)
(“Courts will decide all relevant questions of law arising on review of agency action and set aside
any such action inconsistent with the law as they interpret it.” (citation modified)).
Recall that here, plaintiffs assert that two aspects of the Agencies’ DOGE data access
policies are not in accordance with law—their alleged policy of permitting DOGE affiliates to
access sensitive systems without a need to know the data within those systems, and their policy of
classifying DOGE affiliates as internal agency employees for data disclosure purposes. The Court
has already found that the existence of the former policy is genuinely disputed, see supra 35–36,
so the Court considers only the latter at this juncture.
14 That plaintiffs are organizations does not alter the Court’s analysis. The Privacy Act does not supply a
damages remedy to organizations for obvious reason—the statute protects the data of individuals, not organizations,
so it compensates those same individuals for violations of their rights. But as this Opinion has explained, the Act does
not speak to suits for equitable relief from imminent, unlawful record disclosures. This statutory silence is insufficient
to overcome the well-establish presumption in favor of judicial review of administrative action. And unlike suits for
damages, suits for injunctive and declaratory relief are a mechanism by which organizations may vindicate the rights
of their individual members.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 40 of 48

41
Congress enacted the Privacy Act of 1974 to “protect the privacy of individuals identified
in information systems maintained by Federal agencies.” Pub. L. No. 93-579, 88 Stat. 1896
§ 2(a)(5). Subject to an enumerated list of exceptions, the Privacy Act prohibits agencies from
disclosing “any record which is contained in a system of records by any means of communication
to any person, or to another agency, except pursuant to a written request by, or with the prior
written consent of, the individual to whom the record pertains.” 5 U.S.C. § 552a(b). One exception
to the Privacy Act’s prohibition on nonconsensual record disclosure allows an agency to disclose
records it maintains to its officers and employees who need the records to perform their duties. Id.
§ 552a(b)(1). Both HHS and DOL have promulgated regulations prohibiting record disclosures
that do not comply with the Act. See 45 C.F.R. § 5b.9(a); 29 C.F.R. § 71; 20 C.F.R. § 10.10.
In Judicial Watch, Inc. v. Department of Energy, 412 F.3d 125, 131–32 (D.C. Cir. 2005),
the D.C. Circuit adopted a functional test for determining whether a person is an employee of an
agency. Judicial Watch rejected the proposition that the terms of a detail agreement or the source
of a worker’s pay necessarily define what agency employs that worker. Id. Instead, the D.C.
Circuit invoked law distinguishing independent contractors from employees, and instructed courts
to look at “all the circumstances surrounding the relationship” between the individual and the
agency to determine, as “a practical matter,” what agency employed the individual. Id. (citation
modified). The nature of the person’s work, where the person conducts that work, and who
supervises them are all relevant factors in this analysis. Id.
The Agencies first defend their policy of categorizing DOGE affiliates as agency
employees by contending that the affiliates must be employees because they no longer accept
detailees from USDS. Instead, all their DOGE team members are either dual hires or detailees
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 41 of 48

42
from other agencies. See Defs.’ Mot. at 27; DOGE 30(b)(6) Dep. [ECF No. 82-7] at 77. In their
telling, the Court need not apply Judicial Watch, because the DOGE affiliates’ papers are decisive.
The Court is unpersuaded. There is little functional difference between a DOGE affiliate
hired by USDS and detailed to HHS and other agencies, and a DOGE affiliate hired by GSA and
detailed to USDS, HHS, and other agencies. See, e.g., Defs.’ Interrog. Resp. at 6–7, 26 (describing
Farritor’s concurrent employment). Both arrangements raise questions about what agency, “as a
practical matter,” employs the worker. So the Court must consider “all the circumstances”
surrounding the employment relationships to determine whether the Agencies’ policies accord
with the Privacy Act. Judicial Watch, 412 F.3d at 131–32.
The Agencies characterize these circumstances as entirely unobjectionable, if not
commonplace. They explain that DOGE is an umbrella term, encompassing USDS and a
government-wide initiative to improve bureaucratic efficiency and root out waste, fraud, and
abuse. See Defs.’ Mot. at 30. Put differently, DOGE is both a government-wide initiative and the
entity that coordinates that government-wide initiative. A DOGE affiliate can therefore work on
an agency’s implementation of the initiative as an employee of that agency, and can also coordinate
the broader initiative as an employee of USDS. But never the twain shall meet—while working
on agency projects, the DOGE affiliate works at the agency and reports to agency leadership; while
working on USDS projects, the affiliate works at USDS and reports to USDS leadership. See
DOGE 30(b)(6) Dep. at 27, 81, 84–85, 88.
The Court agrees that such a personnel structure is unlikely to violate the Privacy Act.
Detail arrangements like those the Agencies describe may even be necessary for effective
administration of large, transformative government projects. Yet on the record before it, the Court
cannot confirm that DOGE operates according to this structure.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 42 of 48

43
Plaintiffs offer evidence that DOGE affiliates have been concurrently hired by or detailed
to as many as eight agencies at a time. See id. at 93 (discussing a DOGE affiliate with eight
concurrent appointments); see also Defs.’ Interrog. Resp. at 6–26 (disclosing several DOGE
affiliates with three or more concurrent details). It is implausible that a single worker can faithfully
serve so many independent loci of control. As a practical matter, many simultaneous appointments
tend to align DOGE affiliates’ interests with DOGE, rather than with the agencies that technically
employ them. And interest alignment is a core feature of an employer-employee relationship. See
Dep’t of Interior v. Klamath Water Users Protective Ass’n, 532 U.S. 1, 11 (2001) (explaining that
a consultant may be regarded as an agency employee for FOIA purposes when “the consultant
does not represent an interest of its own, or the interest of any other client, when it advises the
agency”). Concurrent appointments also make it much more likely that DOGE functionally
supervises the affiliates, because DOGE is the entity that guides all their work—not merely 1Ú8 or
even ⅓ of it.
The record bears out what common sense would suggest—DOGE affiliates’ concurrent
employment arrangements were sometimes tailored to serve DOGE’s interests. See, e.g., USDS-
CMS Detail Agreement [ECF No. 80-30] at 1 (declaring that a USDS employee was detailed to
CMS, in part, to guarantee “USDS has full and prompt access” to CMS systems (emphasis added));
USDS-HHS Detail Agreement [ECF No. 80-31] at 1 (same for HHS). And these concurrent
appointments preserved DOGE’s control over the detailed employee. See USDS-CMS Detail
Agreement at 2 (stating that when a detailee conducts CMS work at USDS facilities or on USDS
systems, USDS supervises them); USDS-HHS Detail Agreement at 2 (same for HHS).
Still, the Court is reluctant to declare the Agencies’ policy of treating DOGE affiliates as
agency employees unlawful based on the incomplete record before it. In its interrogatory
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 43 of 48

44
responses, HHS refused to specify the number of federal agencies each of its DOGE affiliates was
concurrently detailed to or employed by. See, e.g., Defs.’ Interrog. Resp. at 5–6, 9, 18 (objecting
to plaintiffs’ interrogatory and then disclosing Elez’s details to USDS and HHS but not the three
other agencies he was detailed to or employed by). HHS’s refusal makes it difficult for the Court
to assess how widespread concurrent appointments were among the HHS DOGE affiliates.
Furthermore, HHS represents that it altered its policies to refuse details from USDS, and
that any detailees that remain at the Agency “are operating under typical detail arrangements from
other agencies.” See Defs.’ Mot. at 27. Fair enough, HHS does not clarify, however, whether its
typical detail arrangements permit concurrent work at many agencies.
Similar concerns arise for DOL. DOL responded to plaintiffs’ interrogatory, revealing that
concurrent details were commonplace among its DOGE affiliates in the Spring of 2025. But a
year has passed since then, and no DOGE affiliates retain access to DOL’s sensitive systems,
leaving the Court uncertain as to DOL’s current policy. See Decl. of T. Burkley [ECF No. 99-1]
¶ 4. As a result, the Court concludes that the record on review is not adequate to assess whether
the Agencies’ data access policies are or were inconsistent with the Privacy Act and denies both
parties’ motions for summary judgment.
The typical next step in such circumstances is to remand to the agency for additional
investigation and explanation. See Fla. Power & Light Co., 470 U.S. at 744. But this matter
presents a special case—the Agencies did not compile a traditional administrative record
contemporaneous to their actions, leading the Court to take the rare step of ordering discovery last
spring. See AFL-CIO III, 349 F.R.D. at 254. The Court will therefore compel HHS to respond to
plaintiffs’ interrogatory and specify the number of federal agencies each of its DOGE affiliates
was concurrently detailed to or employed by. And it will permit both Agencies to file declarations
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 44 of 48

45
with the Court, should they desire, clarifying current policy regarding data access grants to
employees or detailees who are concurrently detailed to or employed by several other agencies.
III. 	Ultra Vires Claim
The plaintiffs’ final claim targets DOGE directly, asserting that its activities were ultra
vires: “unauthorized by any law and . . . in violation of the rights of the individual.” Am. Sch. of
Magnetic Healing v. McAnnulty, 187 U.S. 94, 110 (1902). This “nonstatutory” form of judicial
review derives from the inherent equitable power of courts to “reestablish the limits” on executive
authority after ultra vires acts. Dart v. United States, 848 F.2d 217, 224 (D.C. Cir. 1988); see also
Fed. Express Corp. v. U.S. Dep’t of Com., 39 F.4th 756, 765 (D.C. Cir. 2022).
The scope and stringency of ultra vires review depends on whether plaintiffs’ claim is
statutory or constitutional in nature. See Sustainability Inst. v. Trump, 165 F.4th 817, 829 (4th
Cir. 2026). Where a plaintiff bases their ultra vires claim on allegations that an agency exceeded
its statutory authority, three stringent requirements apply: (i) there must be no express statutory
preclusion of all judicial review; (ii) there must be no alternative procedure for review of the claim;
and (iii) the agency must plainly act “in excess of its delegated powers and contrary to a specific
prohibition in the statute that is clear and mandatory.” Fed. Express Corp., 39 F.4th at 763.
The third requirement for statutory ultra vires review—action contrary to a specific
legislative provision that is “clear and mandatory”—is particularly exacting. Id. at 764–65. To
prevent easy end-runs around statutory constraints on judicial review, it demands not just “garden-
variety errors of law or fact” but a clear departure by the agency from its statutory mandate or
“blatantly lawless” action. Id. (citation modified); see also Nuclear Regul. Comm’n v. Texas, 605
U.S. 665, 681 (2025). In other words, an ultra vires claim alleging executive action in excess of
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 45 of 48

46
statutory authority is “essentially a Hail Mary pass,” it almost never succeeds. Changji Esquel
Textile Co. v. Raimondo, 40 F.4th 716, 722 (D.C. Cir. 2022) (citation modified).
Constitutional ultra vires claims, alleging that the executive exceeded its powers under the
Constitution, need not satisfy these rigorous requirements. See, e.g., Youngstown Sheet & Tube
Co. v. Sawyer, 343 U.S. 579 (1952); see also Glob. Health Council v. Trump, 153 F.4th 1, 14–15
(D.C. Cir. 2025); Sustainability Inst., 165 F.4th at 829.
A doctrinal difficulty lurks within the ultra vires statutory-constitutional dichotomy. Every
statutory ultra vires claim has a constitutional root: executive action in excess of delegated and
inherent authority necessarily violates constitutional guarantees of separation of powers. In Dalton
v. Specter, the Supreme Court addressed this challenge by distinguishing between claims that the
President exceeded specific statutory authority and claims where the President disclaims reliance
on any statute, ostensibly in favor of inherent constitutional authority. 511 U.S. 462, 472 (1994).
Ultra vires claims that allege executive action in excess of statutory authority are statutory in
nature, while ultra vires claims that allege executive action in the “absence” of statutory authority
are constitutional. Id. at 473.
Neither plaintiffs’ complaint nor their terse summary judgment briefing specifies whether
they assert a constitutional or statutory ultra vires claim. See Am. Compl. at 57; Pls.’ Mot. at 35.
In their briefing, they argue both that “no statute created DOGE, or imbued DOGE Teams with
authority to access Sensitive Systems at federal agencies,” implying a claim founded on action in
absence of authority, and that DOGE cannot rely “on the authorities granted to the agencies and
their employees,” implying a claim founded on action in excess of authority. See Pls.’ Mot. at 35.
The Court ultimately construes plaintiffs’ ultra vires claim as statutory for two reasons.
First, plaintiffs appear to concede that the statutory ultra vires requirements apply. In their opening
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 46 of 48

47
brief, plaintiffs cite the Supreme Court’s recent precedent in Nuclear Regulatory Commission v.
Texas, a suit alleging action in excess of statutory authority, and assume it governs this case. See
Pls.’ Mot. at 35 n.4. And when the Agencies contended that plaintiffs’ claim does not satisfy one
of the three required elements for statutory ultra vires review, see Defs.’ Mot. 36–37, plaintiffs did
not dispute the Agencies’ statement of the law, see Pls.’ Reply [ECF No. 97] at 26–27. Second,
plaintiffs fail to invoke the Constitution at any point in their ultra vires briefing. Summary
judgment “is no time for half-hearted advocacy,” Kreg Therapeutics, Inc. v. VitalGo, Inc., 919
F.3d 405, 416 (7th Cir. 2019), so this Court declines to read into the case a constitutional contention
that plaintiffs themselves do not expressly make. See Gov’t of Manitoba v. Bernhardt, 923 F.3d
173, 179 (D.C. Cir. 2019) (refusing to put flesh on the bones of a skeletal argument).
Applying the statutory ultra vires claim requirements here, DOGE is entitled to summary
judgment because plaintiffs do not identify a specific, clear, and mandatory provision—of HHS
and DOL enabling acts, or of any other statute—that DOGE acted in excess of and contrary to.
See Fed. Express Corp, 39 F.4th at 764; see also Fed. R. Civ. P. 56(e). To be sure, identification
of a specific statutory provision is not required for constitutional ultra vires claims because such
claims are founded on an absence of statutory authority. Sustainability Inst., 165 F.4th at 829; see
also AFL-CIO V, 778 F. Supp. 3d at 89 (reasoning that plaintiffs were not required to plead a
specific statutory provision where they challenged DOGE action as in absence of any lawful
authority “statutory or constitutional” (emphasis added)). But as this Court has now explained,
plaintiffs do not advance a constitutional claim.15 The court therefore grants summary judgment
for DOGE on plaintiffs’ statutory ultra vires claim.
15 Plaintiffs’ failure to assert a constitutional violation, grounded in the absence of both statutory and
constitutional authority, is more than a technical briefing error. At least as to the use of HHS and DOL data, a colorable
contention exists that the Constitution’s Take Care Clause vests the executive with inherent authority to use intra-
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 47 of 48

48
CONCLUSION
Summary judgment is only proper where there are no genuine disputes of material fact.
Fed. R. Civ. P. 56(a). Here, real disputes over facts foundational to plaintiffs’ APA claims—
including whether the Agencies altered their data access policies for DOGE affiliates, and whether
DOGE structured those affiliates’ employment relationships such that they were not employees of
the Agencies—persist. Accordingly, the court DENIES the parties’ motions for summary
judgment as to the APA claims (Counts II, IV). Because plaintiffs failed to make an equivalent
showing for their statutory ultra vires claim (Count I), the Court GRANTS defendants’ motion,
and DENIES plaintiffs’ motion as to that claim.
An Order consistent with this Opinion shall issue.
SO ORDERED.
/s/
JOHN D. BATES
United States District Judge
Dated: March 31, 2026
branch data. U.S. Const. art. II, § 3; cf. Whalen v. Roe, 429 U.S. 589, 605 (1977) (discussing the executive’s right to
use a huge swath of data for public purposes, including “the distribution of welfare and social security benefits” and
“the supervision of public health”).
The Court does not mean to imply that Congress cannot restrain inter-agency data-sharing. See Youngstown,
343 U.S. at 637 (Jackson, J., concurring) (discussing a “zone of twilight” in which both Congress and the President
may act). Congress surely can and surely did when it enacted the Privacy Act. It simply observes that no party alleges
that DOGE violated the Privacy Act by receiving HHS and DOL data disclosures, and what legal authority DOGE
may have to use the data, in absence of statutory authority, is nonobvious. So to prevail at summary judgment on the
constitutional version of their ultra vires claim, plaintiffs needed to squarely address these issues. They did not.
Case 1:25-cv-00339-JDB Document 100 Filed 03/31/26 Page 48 of 48