Over a dozen lawsuits to stop DOGE data access are betting on a 1974 law
10:04 Share

Date of birth, home address, social security number. I mean, these are just a few examples of some of the personal information that the U.S. government collects on most of us and stores in databases across federal agencies. Well, the Department of Government Efficiency, or DOGE, created by President Trump, has been causing alarm by making massive cuts to federal staff.

But it has also been seeking access to the troves of personal information that the government has on Americans.

information that can go way beyond a social security number. The level of sensitivity of the information that we're talking about is really unprecedented, and it is the most sensitive information that people provide about themselves. Elizabeth Lair directs the Equity and Civic Technology Project at the Center for Democracy and Technology. She spoke with NPR's Laurel Wamsley. It will include demographics about you, so your race, your sex, even if you have a disability. And then I think the thing that a lot of folks don't think about is

Because a number of the reports of the systems that they've attempted to access or have actually accessed are financial in nature. But they also include really personal information about you. So just to take your tax records, you know, it will include any major life events that you've had. So whether you were pregnant and gave birth to a child or you adopted a child or you got married or divorced.

Whether you went bankrupt, you know, things that maybe your closest friends and family don't even know are included in these systems. And then there's the kind of information that's stored by agencies like Medicare, Medicaid, and the VA. If you are a veteran that's getting medical care from VA,

your medical data is stored in VA databases. What conditions you're being treated for, what treatments you're receiving. If you have a VA therapist or you go to group therapy at VA, then therapy notes are being stored in VA databases. If you, I don't know,

Have an opioid addiction because of an injury that you received while you were in service. That information is going to be potentially stored in the VA database. Jonathan Cammons has worked as a software engineer and cybersecurity professional for more than 30 years. His job was overseeing cybersecurity for the Department of Veterans Affairs main website, or VA.gov.

He was fired from the U.S. Digital Service on February 14th, along with about 40 other people. Kamen says he doesn't know what Elon Musk and his team have access to at the VA, but he is worried about the kind of sensitive data that they could access from what's stored there. There's all sorts of financial information because, you know, in order to apply for benefits, sometimes you have to disclose details about your financial circumstances. So Doge...

claims that what it is trying to do is to find fraud and inefficiency and waste in the federal government so that it can be eliminated. And the single biggest budget line item at the VA is the benefits that are paid out to veterans. So

If you're really looking for fraud and waste and inefficiency, you're not going to be able to do that at VA without looking at the veteran benefit databases, which are the ones that have the personal information in them. Doge's efforts to access these government databases have a lot of people wondering, is there anything that can protect the personal information that we have to hand over to the federal government?

Consider this. A little-known law exists to do just that, protect our sensitive data from government overreach. And more than a dozen lawsuits now invoke this 50-year-old law to stop Doge's access to this information. From NPR, I'm Elsa Chang.

This message comes from Sotva, the first company to sell luxury mattresses online without the hassle or expense of traditional mattress stores. So Sotva customers have always paid about 50% less than retail. Visit s-a-a-t-v-a dot com slash NPR today, where NPR listeners save an additional $200.

This message comes from Charles Schwab. When is the right time to sell a stock? What is the best way to steer your portfolio through an unsteady market? Financial decisions can be tricky. Financial Decoder is an original podcast from Charles Schwab. Host Mark Riepe, head of the Schwab Center for Financial Research, offers practical solutions to help overcome cognitive and emotional biases that may affect our investing decisions.

Listen at schwab.com slash financial decoder or wherever you get your podcasts. This message comes from Greenlight. Parents rank financial literacy as the number one most difficult life skill to teach. With Greenlight, the debit card and money app for families, kids learn to earn, save, and spend wisely. Get started risk-free at greenlight.com slash NPR.

It's Consider This from NPR. Across federal agencies, the government stores a lot of data. And often, the data we entrust to federal agencies is very sensitive and very personal. And so, we're going to talk about some of the data that we're going to be using to

Elon Musk's Department of Government Efficiency, or DOGE, has access to many of the databases storing that personal data. And that's raising alarm. At least a dozen lawsuits are attempting to stop DOGE from tapping into all this personal information. And these lawsuits have focused on one particular legal avenue, a 50-year-old law called the Privacy Act of 1974.

With us to talk about that law is Danielle Citrin. She's a law professor at the University of Virginia. Welcome. Thank you for having me. So before we talk about these lawsuits, can you just take us back to the mid-1970s? How did the Privacy Act of 1974 even come about? Like, what was it designed originally to do?

So it was amidst a time in the late 60s where Congress sort of got wind of the fact that agencies had about 7,000 systems of records or databases. And they got really interested in it because the National Crime Information Center, so the FBI now we think of as the database that shares criminal information between the states, locals, and the feds.

had an incredible amount of sensitive information, including arrests that never went anywhere. And that information was being freely shared with employers, with colleges. So people were losing life opportunities. And, you know, all of this is happening in the backdrop of Watergate, in the backdrop of Hoover's blacklist, which contained files on every single senator and congressman,

There were gathering personal data on each and every one of us that were being shared across agencies without any safeguards. And there was heated agreement across the aisle that we worried that it gave government a lot of power, excessive power that could control us. And I'm sure there are a lot of people out there today who never even knew the Privacy Act of 1974 existed. How...

relevant has this law been over the last 50 years? Like, how much has it been invoked when there are concerns with how the federal government is handling people's private information? The Privacy Act was once a quite sleepy law in my privacy classes. It's gotten increasing prominence, in part because there's been so much compliance with the Privacy Act. Every agency now has to put out notices about having new collections of information and databases, and there's

Chief Privacy Officers at every agency, you have to pay attention to it and adhere to its commitments, which are to ensure that you don't collect information you shouldn't be collecting for a proper purpose and that you're not sharing it unless you meet the conditions of the Privacy Act. Okay, well then let's talk about these dozen or so lawsuits now that concern Access Doge has had to personal data.

Who exactly is filing these lawsuits? Like, what's the argument that the plaintiffs are making here? Privacy groups and attorneys are representing employees of the government and individuals whose data is collected in these systems of records that are protected by the Privacy Act.

And they're arguing that there's real harm here. They're losing their jobs. They're being fired. Presumably, we need to figure out and discover if the loss of those jobs have to do with being in the databases, but we're pretty sure that's probably true. You need to figure out who the employees are so you can fire them. And asserting that the Privacy Act is sacred and that we honor when you turned over your data and you directly gave it to an agency, that it would only be accolades

accessed and used and disclosed pursuant to that reason you gave it to them. And you trusted the government with that information. Okay, but what is the argument that the Trump administration is making for why they are allowed, members of Doge are allowed to access this information?

The Trump administration is arguing that the Doge employees, let's say they're working at the Department of Education, that they have every right to go into these systems of records to check for fraud, waste, and abuse. Simply because they are now employees of the Department of Education? That's right. And it's a fundamental misunderstanding of the Privacy Act.

that if they worked at the Department of Education, they couldn't get into records that include personal data unless it was part of their job, right? And part of the Privacy Act is really specific about conditions on when, for law enforcement purposes, you can disclose information that's protected by the Privacy Act, and it's only when the head of a law enforcement agency makes a written request to

It's really particularized about what records it wants. Even if a judge does rule that federal agencies should not be sharing this sensitive data with Doge, isn't there still the possibility that the Trump administration won't be deterred and will continue to give Doge access anyway?

I'm sorry even to be asking this question right now, but who's to say the Trump administration will care what a judge rules? Right. I mean, that's a fundamental question on the minds of every law professor, lawyer, and law student. That even if, you know, courts so order that Doge employees shouldn't have access to these records and that they should destroy any data that they collected in violation of the Privacy Act, that they may just say, sorry, I'm not going to comply with the court order. And I think

At that moment, when that happens, you know, it's really testing our confidence in democracy and the rule of law. Danielle Citrin is a law professor at the University of Virginia. Thank you very much for speaking with us. Thank you so much. This episode was produced by Catherine Fink. NPR correspondent Laurel Wamsley contributed to the episode. It was edited by Jeanette Woods and Nadia Lansi. Our executive producer is Sammy Yannigan.

It's Consider This from NPR. I'm Elsa Chang. This message comes from EarthX. EarthX 2025 returns in April to Dallas, Texas. One planet and one mission. Five days of innovation and networking with leaders in business, environmental advocacy, and more. Register at earthx.org.

This message comes from NPR sponsor Allianz Travel Insurance. Is this the year you finally plan those trips to Paris, Prague, and Milan? Learn how an all-trips plan can protect your trips all year at AllianzTravelInsurance.com.

Support for NPR and the following message come from Rosetta Stone, the perfect app to achieve your language learning goals no matter how busy your schedule gets. It's designed to maximize study time with immersive 10-minute lessons and audio practice for your commute. Plus, tailor your learning plan for specific objectives like travel. Get Rosetta Stone's lifetime membership for 50% off and unlimited access to 25 language courses. Learn more at rosettastone.com slash NPR.