A US court has ruled that agents working for the Department of Government Efficiency accessed federal agency data illegally, according to a report from heise online. The decision adds a judicial finding to what had until now been a running argument about authority: whether a body created by executive order, staffed largely by affiliates and contractors rather than Senate-confirmed officials, can reach into systems built to hold Americans' tax, health, personnel and benefits records.
The legal ground here is narrow but firm. The Privacy Act of 1974 does not simply restrict who may read a federal record; it restricts disclosure, and it conditions access on need-to-know within the agency that holds the data. Routine-use clauses allow sharing for purposes the agency has published in advance. What they do not allow is a general right of inspection by anyone the White House designates. When the systems in question are the Treasury's payment files or the Social Security Administration's master beneficiary record — both of which became flashpoints — the difference between "access for a stated purpose" and "access because we asked" is the whole case.
The rulings that have gone against the government in this area have tended to converge on procedure rather than politics: that the agencies failed to identify a legal basis, failed to publish the routine-use notice that would have permitted the sharing, or failed to screen the people granted access. Courts have been notably reluctant to declare the underlying programme unconstitutional, and notably willing to say that this particular pipe was laid without a permit.
Which leaves the harder question. A finding that access was illegal is a statement about the past. The remedy is about the present: records already copied, datasets already joined, analyses already run. Federal data rarely comes back. The Privacy Act gives individuals a right to access and amend their records, but no clean mechanism for proving that an unlawful copy was destroyed, and no damages route unless the plaintiff can show an adverse effect — a threshold that is nearly impossible to meet when the harm is a profile rather than a decision.
For technologists the ruling is a reminder that the interesting failures in government data systems are rarely technical. The permissions were set correctly. The audit logs worked. What was missing was a legally valid reason to be in the system at all, and no amount of engineering rigour substitutes for that.
