Alliance for Retired Americans v. Bessent
This text of Alliance for Retired Americans v. Bessent (Alliance for Retired Americans v. Bessent) is published on Counsel Stack Legal Research, covering District Court, District of Columbia primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.
Opinion
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
ALLIANCE FOR RETIRED AMERICANS, et al.,
Plaintiffs,
v. Civil Action No. 25-0313 (CKK)
SCOTT BESSENT, in his official capacity as Secretary of the Treasury, et al.,
Defendants.
MEMORANDUM OPINION (March 7, 2025)
For a time, parts of Silicon Valley embraced an unofficial credo of disruption: “Move Fast
and Break Things.”1 Plaintiffs, three large membership organizations, suggest that parts of the
Executive Branch are now doing the same. Specifically, Plaintiffs argue that officials in the
Department of the Treasury are moving so fast that preliminary injunctive relief is necessary to
protect their members from irreparable harm. And they contend that, absent that relief, Treasury
will break two laws—the Privacy Act of 1974 and the Internal Revenue Code—by disclosing their
members’ personal and financial information to individuals who lack authority to access it.
Plaintiffs’ concerns are understandable and no doubt widely shared. However, on the
present record, Plaintiffs have not cleared the “high standard” of showing a likelihood of an
irreparable injury that is “beyond remediation,” which is a prerequisite to the issuance of a
preliminary injunction in this Circuit. See Chaplaincy of Full Gospel Churches v. England, 454
F.3d 290, 297 (D.C. Cir. 2006). Therefore, upon consideration of the parties’ submissions, the
1 Hemant Taneja, The Era of “Move Fast and Break Things” Is Over, Harv. Bus. Rev. (Jan. 22, 2019), https://hbr.org/2019/01/the-era-of-move-fast-and-break-things-is-over [https://perma.cc/MU46-Q3ZZ].
1 arguments and representations during the Motion Hearing on February 24, 2025, the relevant law,
and the entire record,2 the Court shall DENY Plaintiffs’ [8] Motion for a Preliminary Injunction.
I. BACKGROUND
A. Statutory Framework
1. The Privacy Act
The Privacy Act of 1974, 5 U.S.C. § 552a, “was designed to provide individuals with more
control over the gathering, dissemination, and accuracy of agency information about themselves.”
Greentree v. U.S. Customs Serv., 674 F.2d 74, 76 (D.C. Cir. 1982). The Act was Congress’s
response to “a growing awareness that governmental agencies were accumulating an ever-
expanding stockpile of information about private individuals that was readily susceptible to both
misuse and the perpetuation of inaccuracies that the citizen would never know of, let alone have
an opportunity to rebut or correct.” Londrigan v. FBI, 670 F.2d 1164, 1169 (D.C. Cir. 1981).
Congress enacted the Privacy Act “in conjunction with 1974 legislation amending the
Freedom of Information Act (FOIA).” Londrigan, 670 F.2d at 1169. As a result, the two statutes
are structurally similar, codified together in Title 5, and often read in tandem. “Both FOIA and
the Privacy Act evidence Congressional concern with open government.” Greentree, 670 F.2d at
76. And “[e]ach seeks in different ways to respond to the potential excesses of government.” Id.
2 The Court’s consideration has focused on the following documents, including the attachments and exhibits thereto: • Plaintiffs’ Complaint (“Compl.”), ECF No.1; • Plaintiffs’ Motion for a Preliminary Injunction (“Pls.’ Mot.”), ECF No. 8; • Defendants’ Notice of Correction (“Not. of Correction”), ECF No. 15; • Plaintiffs’ Supplement to the Record (“Pls.’ Suppl.”), ECF Nos. 16-1 to 16-8; • Defendants’ Memorandum in Opposition (“Defs.’ Opp’n”), ECF No. 24; • Defendants’ Supplement to the Record (“Defs.’ Suppl.”), ECF No. 26-1; • Plaintiffs’ Reply in Support of the Motion for a Preliminary Injunction (“Pls.’ Reply”), ECF No. 28; • Defendants’ Supplemental Memorandum (“Defs.’ Mem.”), ECF No. 29; • Plaintiffs’ Supplemental Memorandum (“Pls.’ Mem.”), ECF No. 31; • Plaintiffs’ First Notice of Supplemental Authority (“Pls.’ First Not. of Suppl. Auth.”), ECF No. 33; and • Plaintiffs’ Second Notice of Supplemental Authority (“Pls.’ Second Not. of Suppl. Auth.”), ECF No. 34.
2 FOIA deters government abuses by “open[ing] agency action to the light of public
scrutiny.” Dep’t of Air Force v. Rose, 425 U.S. 352, 372 (1976). The Privacy Act takes a different,
more direct tack. It creates procedures “to give the individual some control over the ways in which
Federal executive agencies handle[] . . . personal information at every stage of the information
process.” Comm’n on Fed. Paperwork, Privacy and Confidentiality: Issues in Information Sharing
21 (1977). As such, the Act imposes burdens on federal agencies and creates rights for individuals
when agencies collect, maintain, use, and disseminate “records.” The Act defines “record”
expansively to include “any item, collection, or grouping of information about an individual that
is maintained by an agency.” 5 U.S.C. § 552a(a)(4).
At the collection stage, the Privacy Act requires that agencies collect information directly
from individuals to the greatest extent possible and inform individuals of the purpose and authority
for that collection. 5 U.S.C. § 552a(e)(2)–(3). If an agency maintains the records it collects such
that information can be retrieved “by the name of [an] individual or by some identifying number,
symbol, or other identifying particular”—a “system of records”—additional responsibilities
obtain. Id. § 552a(a)(5).
Agencies must continuously ensure that records in their systems of records are accurate
and complete to the degree “necessary to assure fairness to the individual[s]” whose information
has been recorded. 5 U.S.C. § 552a(e)(5). To enforce that requirement, the Act dictates that any
individual can access and review all records “pertaining to” the individual in an agency’s system.
Id. § 552a(d)(1). If the individual identifies an error in the record, the Act grants the right to
request an amendment. Id. § 552a(d)(2). If that request is denied, or if the agency refuses to allow
the individual to review the relevant records, the affected individual may bring suit in federal
district court and obtain an injunction ordering the agency to comply. Id. §§ 552a(d)(3),
3 (g)(1)(A)–(B), (g)(2)–(3). And if that process fails, and the agency makes a determination adverse
to an individual because of an inaccuracy in its records, the Act provides a backstop: a suit for
damages. Id. §§ 552a(g)(1)(C), (g)(2)(4).
Most importantly for purposes of this case, the Act also prohibits federal agencies from
sharing records about individuals, except under certain limited circumstances:
No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless [an enumerated exception applies].
5 U.S.C. § 552a(b). The Act’s enumerated exceptions allow disclosure of a record “to those
Free access — add to your briefcase to read the full text and ask questions with AI
UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA
ALLIANCE FOR RETIRED AMERICANS, et al.,
Plaintiffs,
v. Civil Action No. 25-0313 (CKK)
SCOTT BESSENT, in his official capacity as Secretary of the Treasury, et al.,
Defendants.
MEMORANDUM OPINION (March 7, 2025)
For a time, parts of Silicon Valley embraced an unofficial credo of disruption: “Move Fast
and Break Things.”1 Plaintiffs, three large membership organizations, suggest that parts of the
Executive Branch are now doing the same. Specifically, Plaintiffs argue that officials in the
Department of the Treasury are moving so fast that preliminary injunctive relief is necessary to
protect their members from irreparable harm. And they contend that, absent that relief, Treasury
will break two laws—the Privacy Act of 1974 and the Internal Revenue Code—by disclosing their
members’ personal and financial information to individuals who lack authority to access it.
Plaintiffs’ concerns are understandable and no doubt widely shared. However, on the
present record, Plaintiffs have not cleared the “high standard” of showing a likelihood of an
irreparable injury that is “beyond remediation,” which is a prerequisite to the issuance of a
preliminary injunction in this Circuit. See Chaplaincy of Full Gospel Churches v. England, 454
F.3d 290, 297 (D.C. Cir. 2006). Therefore, upon consideration of the parties’ submissions, the
1 Hemant Taneja, The Era of “Move Fast and Break Things” Is Over, Harv. Bus. Rev. (Jan. 22, 2019), https://hbr.org/2019/01/the-era-of-move-fast-and-break-things-is-over [https://perma.cc/MU46-Q3ZZ].
1 arguments and representations during the Motion Hearing on February 24, 2025, the relevant law,
and the entire record,2 the Court shall DENY Plaintiffs’ [8] Motion for a Preliminary Injunction.
I. BACKGROUND
A. Statutory Framework
1. The Privacy Act
The Privacy Act of 1974, 5 U.S.C. § 552a, “was designed to provide individuals with more
control over the gathering, dissemination, and accuracy of agency information about themselves.”
Greentree v. U.S. Customs Serv., 674 F.2d 74, 76 (D.C. Cir. 1982). The Act was Congress’s
response to “a growing awareness that governmental agencies were accumulating an ever-
expanding stockpile of information about private individuals that was readily susceptible to both
misuse and the perpetuation of inaccuracies that the citizen would never know of, let alone have
an opportunity to rebut or correct.” Londrigan v. FBI, 670 F.2d 1164, 1169 (D.C. Cir. 1981).
Congress enacted the Privacy Act “in conjunction with 1974 legislation amending the
Freedom of Information Act (FOIA).” Londrigan, 670 F.2d at 1169. As a result, the two statutes
are structurally similar, codified together in Title 5, and often read in tandem. “Both FOIA and
the Privacy Act evidence Congressional concern with open government.” Greentree, 670 F.2d at
76. And “[e]ach seeks in different ways to respond to the potential excesses of government.” Id.
2 The Court’s consideration has focused on the following documents, including the attachments and exhibits thereto: • Plaintiffs’ Complaint (“Compl.”), ECF No.1; • Plaintiffs’ Motion for a Preliminary Injunction (“Pls.’ Mot.”), ECF No. 8; • Defendants’ Notice of Correction (“Not. of Correction”), ECF No. 15; • Plaintiffs’ Supplement to the Record (“Pls.’ Suppl.”), ECF Nos. 16-1 to 16-8; • Defendants’ Memorandum in Opposition (“Defs.’ Opp’n”), ECF No. 24; • Defendants’ Supplement to the Record (“Defs.’ Suppl.”), ECF No. 26-1; • Plaintiffs’ Reply in Support of the Motion for a Preliminary Injunction (“Pls.’ Reply”), ECF No. 28; • Defendants’ Supplemental Memorandum (“Defs.’ Mem.”), ECF No. 29; • Plaintiffs’ Supplemental Memorandum (“Pls.’ Mem.”), ECF No. 31; • Plaintiffs’ First Notice of Supplemental Authority (“Pls.’ First Not. of Suppl. Auth.”), ECF No. 33; and • Plaintiffs’ Second Notice of Supplemental Authority (“Pls.’ Second Not. of Suppl. Auth.”), ECF No. 34.
2 FOIA deters government abuses by “open[ing] agency action to the light of public
scrutiny.” Dep’t of Air Force v. Rose, 425 U.S. 352, 372 (1976). The Privacy Act takes a different,
more direct tack. It creates procedures “to give the individual some control over the ways in which
Federal executive agencies handle[] . . . personal information at every stage of the information
process.” Comm’n on Fed. Paperwork, Privacy and Confidentiality: Issues in Information Sharing
21 (1977). As such, the Act imposes burdens on federal agencies and creates rights for individuals
when agencies collect, maintain, use, and disseminate “records.” The Act defines “record”
expansively to include “any item, collection, or grouping of information about an individual that
is maintained by an agency.” 5 U.S.C. § 552a(a)(4).
At the collection stage, the Privacy Act requires that agencies collect information directly
from individuals to the greatest extent possible and inform individuals of the purpose and authority
for that collection. 5 U.S.C. § 552a(e)(2)–(3). If an agency maintains the records it collects such
that information can be retrieved “by the name of [an] individual or by some identifying number,
symbol, or other identifying particular”—a “system of records”—additional responsibilities
obtain. Id. § 552a(a)(5).
Agencies must continuously ensure that records in their systems of records are accurate
and complete to the degree “necessary to assure fairness to the individual[s]” whose information
has been recorded. 5 U.S.C. § 552a(e)(5). To enforce that requirement, the Act dictates that any
individual can access and review all records “pertaining to” the individual in an agency’s system.
Id. § 552a(d)(1). If the individual identifies an error in the record, the Act grants the right to
request an amendment. Id. § 552a(d)(2). If that request is denied, or if the agency refuses to allow
the individual to review the relevant records, the affected individual may bring suit in federal
district court and obtain an injunction ordering the agency to comply. Id. §§ 552a(d)(3),
3 (g)(1)(A)–(B), (g)(2)–(3). And if that process fails, and the agency makes a determination adverse
to an individual because of an inaccuracy in its records, the Act provides a backstop: a suit for
damages. Id. §§ 552a(g)(1)(C), (g)(2)(4).
Most importantly for purposes of this case, the Act also prohibits federal agencies from
sharing records about individuals, except under certain limited circumstances:
No agency shall disclose any record which is contained in a system of records by any means of communication to any person, or to another agency, except pursuant to a written request by, or with the prior written consent of, the individual to whom the record pertains, unless [an enumerated exception applies].
5 U.S.C. § 552a(b). The Act’s enumerated exceptions allow disclosure of a record “to those
officers and employees of the agency which maintains the record who have a need for the record
in the performance of their duties.” Id. § 552a(b)(1). They also allow disclosure for “a routine
use.” Id. § 552a(b)(3). A “routine use” is a use of a record “for a purpose which is compatible
with the purpose for which it was collected.” Id. § 552a(a)(7). Each time an agency “establish[es]
or revis[es]” a system of records, it must publish a notice in the Federal Register detailing, among
other things, “each routine use of the records contained in the system, including the categories of
users and the purpose of such use.” Id. § 552a(e)(4).
The Act does not specifically provide a remedy for violations of its prohibition on
disclosure. Instead, that prohibition is made enforceable through a catch-all remedial provision
applicable when the agency “fails to comply with any other provision of this section”—that is, any
provision other than those relating to accessing and correcting records. Id. § 552a(g)(1)(D). If the
agency’s failure has “an adverse effect on an individual,” the affected person may bring a civil suit
in federal district court. Id. And if that failure “was intentional or willful,” the plaintiff may obtain
attorney’s fees and the greater of the plaintiff’s actual damages or $1,000. Id. § 552a(g)(4).
4 The Act also provides criminal penalties for willful violations of its requirements. See 5
U.S.C. § 552a(i). It is a federal crime for any agency officer or employee willfully to disclose a
protected record “in any manner to any person or agency not entitled to receive it,” id. § 552a(i)(1),
or to maintain a system of records “without meeting the notice requirements” provided in the Act,
id. § 552a(i)(2). It is also a federal crime for any person to “request[] or obtain[] any record
concerning an individual from an agency under false pretenses.” Id. § 552a(i)(3).
2. The Internal Revenue Code
The Internal Revenue Code requires less introduction. Along with its obvious functions,
the Code also restricts agencies’ access to and use of certain financial information. Section 6103
of the Code provides that tax “[r]eturns and return information shall be confidential,” and that:
[E]xcept as authorized by [the Code] . . . no officer or employee of the United States, . . . [and] no other person . . . who has or had access to returns or return information under [various Code provisions providing for that access], shall disclose any return or return information obtained by him in any manner in connection with his service as such an officer or an employee or otherwise or under the provisions of this section.
26 U.S.C. § 6103(a). As used in this provision, the term “officer or employee” includes a former
officer or employee. Id.
The Code permits taxpayers to seek damages from the United States for any knowing or
negligent inspection or disclosure of tax returns or return information. 26 U.S.C. § 7431(a). But
the United States is not liable for any inspection or disclosure that the taxpayer requests or that
results from “a good faith, but erroneous, interpretation” of the Code’s confidentiality
requirements. Id. § 7431(b). Willful violations of the rule against disclosure are also punishable
as felonies, and any federal officer or employee convicted of such a violation “shall, in addition to
any other punishment, be dismissed from office or discharged from employment.” Id.
§ 7213(a)(1).
5 3. The Administrative Procedure Act
The Administrative Procedure Act (“APA”) provides a cause of action against an “agency”
or “an officer or employee thereof” to any “person . . . adversely affected or aggrieved by agency
action within the meaning of a relevant statute.” 5 U.S.C. § 702. The APA waives the sovereign
immunity of the United States for “relief other than money damages” in such an action. Id.; Med.
Imaging & Tech. All. v. Libr. of Cong., 103 F.4th 830, 836 (D.C. Cir. 2024). Judicial review is
available under the APA only for “final agency action for which there is no other adequate remedy
in a court.” 5 U.S.C. § 704.
B. Factual Background
1. The Bureau of the Fiscal Service
The Bureau of the Fiscal Service (“BFS”) is part of the Department of the Treasury. It is
the successor to two former agencies within Treasury, the Fiscal Management Service and the
Bureau of the Public Debt, which Treasury Secretary Timothy Geithner consolidated in October
2012. See Treasury Order 136-01 (Oct. 7, 2012), https://home.treasury.gov/about/general-
information/orders-and-directives/treasury-order-136-01 [https://perma.cc/D36S-HQC6]. BFS
handles 87.8% of the payments made by the federal government, totaling $5.46 trillion each year.
Decl. of Vona S. Robinson (“Robinson Decl.”), ECF No. 24-4, ¶ 2.
To carry out this important mission, BFS maintains multiple systems that hold sensitive
information about federal payments and the recipients of those payments. These systems include
the Payment Automation Manager (“PAM”), which is Treasury’s “primary application” used “to
process payment for disbursement,” and the Secure Payment System (“SPS”), which agencies use
to “create, certify, and submit payment files” to Treasury for payment. Robinson Decl. ¶ 4. The
SPS is also “typically used for one-time large dollar amount transactions.” Id.
6 BFS’s payment systems contain records with extensive details about individual recipients
of federal payments. For any given payee, these details may include:
name, Social Security number, employer identification number, or other agency identification or account number; date and location of birth, physical and/or electronic mailing address; telephone numbers; payment amount; date of issuance; trace number or other payment identification number, such as Treasury check number and symbol; financial institution information, including the routing number of his or her financial institution and the payee’s account number at the financial institution; and vendor contract and/or purchase order number.
Bureau of the Fiscal Service Notice of Systems of Records, 85 Fed. Reg. 11776, 11779 (Feb. 27,
2020).
2. The U.S. DOGE Service
On January 20, 2025, President Donald J. Trump signed an Executive Order purporting to
establish a “Department of Government Efficiency,” a new initiative with the stated goal of
“modernizing Federal technology and software to maximize governmental efficiency and
productivity.” Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 20, 2025) § 1. The President’s
Executive Order renamed the existing United States Digital Service as the “United States DOGE
Service” (“USDS” or “DOGE”) and provided that its leader, the “USDS Administrator,” would
report directly to the White House Chief of Staff. Id. § 3(a)–(b). The Executive Order also
established the “U.S. DOGE Service Temporary Organization.” Id. § 3(b). Defendants’ counsel
has represented that, for present purposes, USDS and the “U.S. DOGE Service Temporary
Organization” are “one and the same.” Transcript of Feb. 24, 2025 Preliminary Injunction Hearing
(“Feb. 24 Tr.”), ECF No. 36, at 60:9–14.
The Executive Order further directed the heads of each federal agency to “establish within
their respective agencies a DOGE Team of at least four employees” within 30 days. Exec. Order
No. 14,158 § 3(c). These employees may include “Special Government Employees.” Id. A
7 Special Government Employee may be, as relevant here, a temporary “officer or employee” who
is “retained, designated, appointed, or employed to perform, with or without compensation . . .
temporary duties either on a full-time or intermittent basis” for up to 130 days in any consecutive
365-day period. 18 U.S.C. § 202(a). Special Government Employees are exempt from some of
the ethics rules that apply to most federal employees. See 18 U.S.C. §§ 203, 205, 207–209.
Finally, the Executive Order directed the heads of federal agencies to “take all necessary
steps, in coordination with the USDS Administrator and to the maximum extent consistent with
law, to ensure USDS has full and prompt access to all unclassified agency records, software
systems, and IT systems.” Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 20, 2025) § 4(b).
3. The Treasury DOGE Team
In the early days of the new Administration, two people received assignments to work at
Treasury in connection with “the President’s DOGE efforts.” See Feb. 8 Decl. of Thomas H.
Krause, Jr. (“Krause Decl. I”), ECF No. 15-1, ¶¶ 1, 11; Feb. 12 Decl. of Thomas H. Krause, Jr.
(“Krause Decl. II”), ECF No. 24-1, ¶ 11; Decl. of Michael J. Wenzler (“Wenzler Decl.”), ECF No.
24-3, ¶¶ 3, 9.
The first person assigned, Marko Elez, was named a “Special Advisor for Information
Technology and Modernization” on January 21, 2025. Wenzler Decl. ¶ 9. Elez was appointed as
a “temporary transitional Schedule C” employee under 5 C.F.R. § 213.3302, which allows certain
temporary appointments “during the 1-year period immediately following a change in presidential
administration.” Wenzler Decl. ¶ 9. In this role, Elez was responsible for conducting “special and
confidential studies on a variety of strategies and issues related to Treasury’s information
technology,” analyzing Treasury systems, and “making recommendations to strengthen Treasury’s
8 hardware and software.” Id. ¶ 10. Because Elez was not designated a Special Government
Employee, he was bound by the same ethics rules as most federal employees. Id. ¶ 11.
Elez resigned from Treasury on February 6, 2025. Wenzler Decl. ¶ 12. After BFS received
notice of Elez’s resignation, it “revoked or removed all physical and logical access and recovered
all Treasury equipment,” including laptops, a cell phone, and access cards. Gioeli Decl. ¶ 22.
There is no indication in the record that Elez retains access to any BFS payment data, source code,
or systems. See id.; Krause Decl. I ¶ 11.
The second person assigned to Treasury in connection with “the President’s DOGE
efforts,” Thomas H. Krause, Jr., started work on January 23, 2025, as a “Senior Advisor for
Technology and Modernization.” Krause Decl. II ¶¶ 1, 11. Krause serves as Treasury’s “DOGE
Team lead” and still works at Treasury. Id. ¶ 2, see Wenzler Decl. ¶ 3.; Feb. 13 Decl. of Thomas
H. Krause, Jr. (“Krause Decl. III”), ECF No. 25-1, ¶ 1.
When Krause signed his Treasury appointment paperwork, and took an oath of office on
January 23, he was “onboarded” as a “consultant” under the authority of 5 U.S.C. § 3109. Wenzler
Decl. ¶ 4; Krause Decl. III ¶ 3. But the appointing official at Treasury did not execute Krause’s
appointment paperwork until February 3. Wenzler Decl. ¶ 5. When executed, this paperwork
identified Krause’s start date as February 9—more than two weeks after he began working at
Treasury. Id. On February 10, the appointing official “executed revised appointment
documentation” for Krause, backdating his appointment to January 23. Id.
On February 5, Treasury Secretary Scott Bessent delegated the duties of the Fiscal
Assistant Secretary to Krause. Krause Decl. II ¶ 5. But because Krause had been appointed to
Treasury as a “consultant” under 5 U.S.C. § 3109, he was not authorized to “perform managerial
or supervisory work” except as “team leader or director of the specific project for which he . . .
9 [was] hired.” See 5 C.F.R. § 304.103(b)(3); Krause Decl. III ¶ 3. Krause therefore did not assume
the duties of the Fiscal Assistant Secretary until February 13, when he was sworn into an
appointment as a “temporary transitional Schedule C” employee. See Krause Decl. III ¶ 4.
At all times, unlike Elez, Krause has been designated as a Special Government Employee,
meaning he is exempt from certain ethics rules that apply to most federal employees. Id. ¶ 4.
Krause also serves as the Chief Executive Officer of Cloud Software Group, Inc., a private
company in the enterprise software industry. Krause Decl. II ¶ 1. He has kept this role while in
government service and works without pay at Treasury. Id.
Treasury officials initially authorized Krause to have “‘over the shoulder’ access to view
BFS payment data, payment systems, and copied source code that was being accessed by other
Treasury employees with appropriate access to the data or systems.” Krause Decl. I, ¶ 9. However,
Krause has never had “direct or personal access to BFS payment data, code, or systems.” Id. And
as of February 8, in compliance with a temporary restraining order entered in the U.S. District
Court for the Southern District of New York, Krause no longer has “over the shoulder” access to
BFS systems. Krause Decl. I at ¶ 9; see also New York v. Trump, No. 25-cv-1144-JAV, ECF No.
76 at 63–64 (S.D.N.Y. Feb. 21, 2025) (granting preliminary injunction).
Since this case began, Treasury has made plans to onboard three more people to serve as
part of the Treasury DOGE Team. See Decl. of John York (“York Decl.”), ECF No. 30-1, ¶ 3.
One of these individuals, Ryan Wunderly, is slated to fill the position previously held by Marko
Elez. Id. Like Elez, Wunderly will be appointed through a temporary transitional Schedule C
appointment, and his “position description and job duties will be substantially the same as those
of Mr. Elez.” Id. ¶ 4. Wunderly will also be “subject to the same risk mitigation measures
Treasury previously applied to Mr. Elez.” Id. ¶ 6. The two other members of the Treasury DOGE
10 Team will “be working principally at the Internal Revenue Service” and will not have access to
BFS payment systems. Id. ¶¶ 3, 6.
4. The BFS Payment Process Engagement Plan
On January 26, 2025, BFS “initiated” a “payment process engagement plan” with the
Treasury DOGE Team. Krause Decl. II ¶ 13. This plan provided that BFS would “support the
Treasury DOGE Team”—at the time, Krause and Elez—for a period of four to six weeks. Krause
Decl. II ¶ 13; Robinson Decl. ¶ 6. Treasury Secretary Bessent “approved the engagement in the
early days of the new Administration.” Krause Decl. II ¶ 15.
The objective of the payment process engagement is “to gain insight into the full, end-to-
end payment process across multiple BFS systems” and “identify gaps that, if resolved, would
make the system . . . work more efficiently and securely.” Krause Decl. II ¶ 13. The engagement’s
purposes also include “understand[ing] BFS payment processes and identify[ing] opportunities to
advance payment integrity and fraud reduction goals.” Robinson Decl. ¶ 6.
Toward those ends, one of the engagement’s early goals was to ensure that all payments
made through BFS systems are tagged with symbols and codes identifying the type of the payment
and the type of account receiving the payment. Krause Decl. II ¶ 14. These symbols and codes
are intended to help the federal government account for its spending more accurately. Id. The
Treasury DOGE Team “agreed to help” with the process of adding these symbols and codes “in
support of its goal of modernizing and identifying inefficiencies.” Id.
Because understanding “the full end-to-end payment process, across multiple payment
systems,” was “an important part of” the Treasury DOGE Team’s work on the payment process
engagement, that work “required review of the source code for BFS’s payment systems as well as
11 the ability to review sensitive payment data.” Krause Decl. II ¶ 15; see also Decl. of Joseph
Gioeli III (“Gioeli Decl.”), ECF No. 24-2, ¶ 13.
BFS officials recognized that the access they were providing to the Treasury DOGE Team
as part of this engagement was “broader in scope than what has occurred in the past.” Gioeli Decl.
¶ 13. Specifically, BFS had never provided “a single individual with access to multiple systems
and data records,” as it did for the Treasury DOGE Team. Id. Although BFS had provided
extensive “read-only” access to Treasury systems to auditors in the past, “in those scenarios the
availability of production data”—that is, sensitive data about real federal payments and payees—
“was significantly limited.” Id. By contrast, BFS officials have not identified any limitations
placed on the Treasury DOGE Team’s ability to view “production data” through secure BFS
systems as part of the new payment process engagement. See id. ¶¶ 11–13.
BFS officials also recognized that allowing “broad access” to such sensitive information
would present “risks,” including “potential operational disruptions” to payment systems, risk of
improper “access to sensitive data elements,” and “insider threat risk.” Gioeli Decl. ¶ 11.
To mitigate these risks “to the extent possible,” BFS officials took several measures to
monitor and control the Treasury DOGE Team’s access to BFS systems. Gioeli Decl. ¶¶ 12–15.
For example, BFS chose just one person, Elez, to be the “technical team member” with direct,
personal access to BFS systems and data for use in the engagement. Id. ¶ 14; Krause Decl. II ¶ 3.
Krause would have “over the shoulder” access and would be authorized to receive updates from
Elez about his work, but Krause would not have direct access. Gioeli Decl. ¶ 4. BFS provided
Elez with a dedicated laptop to use with BFS systems, and all usage of this laptop was
automatically logged. Id. ¶¶ 12, 21. To allow Elez to review and interact with source code for
BFS systems without directly modifying active BFS systems, BFS set up a “secure code
12 repository” or “sandbox” environment that would allow Elez to “review and make changes locally
to copies of the source code” in a “cordoned-off” setting in which he “did not have the authority
or capability to publish any code changes to the production system or underlying test
environments.” Id. ¶ 16. BFS officials also planned to provide Elez with “read-only” access to
BFS payment systems, meaning that he would not have the ability to modify any records stored in
any BFS systems. Id. ¶ 13.
However, operating on a compressed timeline, BFS officials failed to implement some of
these protective measures as planned. On February 5, a BFS employee mistakenly granted Elez
“read/write permissions” for the Secure Payment System (“SPS”), a BFS system that federal
agencies use to “create, certify, and submit individual payment files to Treasury” for processing.
Gioeli Decl. ¶¶ 5, 8, 20. SPS is the system “typically used for one-time large dollar amount
transactions.” Id. ¶ 8. BFS personnel corrected Elez’s access to be “read-only” on the morning of
February 6. Id. ¶ 20. Elez resigned from Treasury the same day. Id. ¶ 22.
Despite the configuration mistake, BFS officials believe that Elez never exercised his
“write” permissions on the SPS database. Gioeli Decl. ¶ 20. An initial “forensic investigation”
by BFS officials into Elez’s access “confirmed” that Elez interacted with the system only during a
“supervised, walk-through session” and that “no unauthorized actions had taken place.” Id. As of
February 24, a complete “forensic analysis” of Elez’s activities had not yet been completed. See
id.; Feb. 24 Tr. at 107:23–108:2
5. The DOGE Team’s Use of BFS Systems to Review Foreign Aid Payments
On or about January 26, 2025, Treasury leaders “approved a process” intended to “assist
agencies in complying with the President’s January 20, 2025 Executive Order on foreign aid.”
Robinson Decl. ¶ 7. The President’s Executive Order directed agencies to pause foreign
13 development assistance payments “immediately,” but it provided that the Secretary of State “may
waive the pause” for “specific programs.” See Exec. Order 14,169, 90 Fed. Reg. 8619 (Jan. 20,
2025) § 3(a), (e); Krause Decl. II ¶ 17. To assist in the implementation of this Order, the Treasury
DOGE Team and BFS worked to identify “payments that matched certain Treasury Account
Symbols (TAS) associated with foreign payments” and “flag[] those payments for the State
Department for review consistent with the Executive Order.” Krause Decl. II ¶¶ 18–20.
“Treasury leadership” initially directed BFS on January 26 to “develop a process to identify
all USAID payment files within the [Payment Automation Manager] file system’s ‘landing zone’”
and “flag those payments for the State Department . . . prior to their entry into” BFS’s payment
processing systems. Robinson Decl. ¶ 8. However, on January 27, “Treasury leadership informed
BFS that the State Department had decided to intercept the USAID files prior to the initial
submission to BFS,” making it “unnecessary to continue to flag any USAID payment files for the
State Department’s review.” Id.
Later, on January 31, BFS was directed to identify payment files matching any of four
specific “Treasury Account Symbol” codes—codes indicating that the proposed payments may
have been related to foreign aid—and to provide copies of those payment files to “certain
designated Department of State officials” for their review and a determination of whether “the
Executive Order required a pause” on the payments. Robinson Decl. ¶ 10. The present record
does not reveal who gave this direction. See id. To complete this task, “BFS career staff queried
the PAM file system manually to identify payment files.” Id. ¶ 11. BFS career staff also shared
the relevant payment files with Elez. Id. Later, Elez “assisted in automating the manual review
of the payment files.” Id. The record does not indicate exactly which systems Elez accessed or
used to accomplish this task; however, based on BFS’s “preliminary log reviews,” on February 3,
14 Elez “copied two USAID files directly from the PAM database to his BFS laptop”; on February 4
and 5, he “accessed the PAM file system; and on February 5, he “accessed the PAM payment
processing database.” Gioeli Decl. ¶ 18. BFS’s preliminary reviews concluded that Elez “did not
change or alter any BFS payment system or record within their source systems.” Id.
The record indicates that only one payment was halted as a result of BFS’s new process for
reviewing foreign aid payments: On February 10, BFS identified a payment request from the
Department of the Interior on behalf of the Millenium Challenge Corporation, which it forwarded
to authorized officials at the State Department for that Department’s review. Robinson Decl. ¶¶
14, 16. Later that day, an official from the Department of the Interior requested that BFS not
process the payment. Id. BFS also identified four other payment files and forwarded them to
authorized officials at the State Department, but the State Department instructed that those
payments “could be processed normally.” Id. ¶ 13. Those files “were then processed in the normal
course that same day.” Id.
Since February 10, BFS has “ensured that the State Department review process will not
proceed for payment requests within the scope of the [temporary restraining order] issued in New
York v. Trump, No. 1:25-cv-39-JJM-PAS,” a case pending in the U.S. District Court for the District
of Rhode Island. Robinson Decl. ¶ 12.
In sum, the present record shows that Defendants, acting in haste, made multiple mistakes
in onboarding the Treasury DOGE Team. There is no indication in the present record that these
mistakes have resulted in disclosures outside the federal government, but neither is there any
indication that Defendants have yet completed any independent forensic review to determine
exactly what information may have been shared outside Treasury.
15 6. The Plaintiff Organizations
Plaintiffs in this case are three membership organizations: Alliance for Retired Americans
(“Alliance”); American Federation of Government Employees, AFL-CIO (“AFGE”); and Service
Employees International Union (“SEIU”). Compl. ¶¶ 10–12. Each of these organizations
advocates on behalf of its members’ social and economic interests. See Decl. of Richard J. Fiesta
(“Fiesta Decl.”), ECF No. 8-2, ¶ 3; Decl. of Everett Kelley (“Kelley Decl.”), ECF No. 8-3, ¶ 3;
Decl. of Steven K. Ury (“Ury Decl.”), ECF No. 8-4, ¶ 3. And each has many thousands of
members who receive payments from the federal government, meaning that Treasury holds their
bank information and other sensitive identifying information about them. Fiesta Decl. ¶¶ 4–6;
Kelley Decl. ¶¶ 4–6; Ury Decl. ¶¶ 4–6. Many of these members are concerned that having this
information shared with individuals associated with DOGE violates their privacy and increases the
risk that they will become victims of identity theft or other misuses of their personal information.
See, e.g., Fiesta Decl. ¶¶ 7–9; Kelley Decl. ¶¶ 7–9; Ury Decl. ¶¶ 7–9; Decl. of Carol Rosenblatt
(“Rosenblatt Decl.”), ECF No. 16-2, ¶¶ 7–10; Decl. of Jeanette L. McElhaney (“McElhaney
Decl.”), ECF No. 16-3, ¶¶ 7–10; Decl. of Barabara Casey (“Casey Decl.”), ECF No. 16-4, ¶¶ 7–
10; Decl. of Henrietta Jenkins (“Jenkins Decl.”), ECF No. 16-5, ¶¶ 7–10; Decl. of Pia Morrison
(“Morrison Decl.”), ECF No. 16-6, ¶¶ 5–8; Decl. of Patrice Peterson (“Peterson Decl.”), ECF No.
16-7, ¶¶ 6–9; Decl. of Susan Tousignant (“Tousignant Decl.”), ECF No. 16-8, ¶¶ 6–9.
C. Procedural History
Plaintiffs filed the Complaint in this matter on February 3, 2025. ECF No. 1. Two days
later, they moved for a temporary restraining order enjoining Defendants “from disclosing
information about individuals to individuals affiliated with the” USDS and further enjoining
Defendants “to retrieve and safeguard any information that has already been obtained by [USDS]
16 or individuals associated with it.” Pl.’s Mot., ECF No. 8, at 1. In response, this Court ordered the
parties to appear for a hearing on February 5 “to answer factual questions related to the Plaintiffs’
allegations and set an expedited briefing schedule on the Plaintiffs’ Motion.” Order, ECF No. 10.
During that preliminary hearing, Defendants’ counsel made representations to the Court
about the scope of access granted to the BFS systems of records. See generally Transcript of Feb.
5, 2025 Scheduling Conference (“Feb. 5 Tr.”), ECF No. 14.
First, counsel stated that “[t]here is one person who has been given access to the systems”:
Marko Elez. Feb. 5 Tr. at 7:3–5. Counsel further represented that Mr. Elez “is a Treasury
employee”—specifically, a “Special Government Employee[] within the Treasury Department.”
Id. at 7:9, 12:25–13:4. According to counsel, Mr. Elez had “read-only access” to BFS systems in
his capacity as a Special Government Employee and had not disclosed the records in those systems
to anyone “outside of the Treasury Department.” Id. at 15:1–7.
Second, counsel reported that Thomas Krause—another “Treasury employee”—“is
provided information from the [BFS] system[s]” but “does not have direct access to” those systems
himself. Feb. 5 Tr. at 7:10–13. Put differently, counsel represented that although Krause “does
not actually work in the system . . . information [from the system] is provided to him through Mr.
Elez.” Id. at 38:17–21. Counsel reported that he was “unaware of any plan in which the employees
who are located in the Treasury Department, Mr. Krause and Mr. Elez, . . . would share”
information in BFS systems with anyone else. Id. at 25:15–19. Instead, counsel’s “understanding
[was] that they are the ones who will be reviewing the records and that [the records] will not leave
the Treasury Department.” Id. at 25:19–21.
Defendants later clarified that some of these early representations to the Court were
inaccurate. On February 10, Defendants filed a Notice of Correction to advise the Court that Elez
17 was not, in fact, a Special Government Employee, as Defendants’ counsel had been informed prior
to the preliminary hearing; instead, Elez was hired by Treasury as a temporary transitional
Schedule C employee. See Defs.’ Not. of Correction, ECF No. 15.
Two days later, on February 12, Defendants filed another declaration stating that Elez had
mistakenly been given “read/write permissions,” rather than “read only” permissions, for one BFS
database. Gioeli Decl. ¶ 20. This declaration also stated that that BFS officials “have found no
indication . . . that Mr. Elez used his BFS laptop to share any BFS payment systems data outside
the U.S. Government,” leaving open the possibility—contrary to the information Defendants’
counsel conveyed at the preliminary hearing—that Elez may have shared BFS records outside of
Treasury. Id. ¶ 21. Defendants also filed a separate declaration stating that Elez had participated
in a new initiative to share certain BFS payment files with State Department officials. Robinson
Decl. ¶¶ 8–11. Based on this information, Defendants now admit that Elez “may have taken part
in helping disseminate information from BFS systems outside of Treasury as part of the new State
Department review process,” but they do not specify exactly who may have received that
information. See Defs.’ Opp’n at 6–7 & n.2.
During the preliminary hearing on February 5, the Court encouraged the parties to confer
and determine whether they could reach agreement on a consent order that would preserve the
status quo pending full briefing and consideration of a motion for a preliminary injunction. See
Feb. 5 Tr. at 25:22–26:12; 27:4–28:14. Plaintiffs agreed to convert their Motion for a Temporary
Restraining Order into a Motion for a Preliminary Injunction if the Court entered such an order.
Id. at 45:25–46:1; see Min. Order (Feb. 2, 2025).
Soon after the preliminary hearing concluded, the parties agreed on a consent order to
preserve the status quo and jointly requested that the Court enter that order. See Joint Mot. for
18 Entry of Proposed Order, ECF No. 11. The Court then entered the parties’ proposed order and
converted the Plaintiffs’ Motion for a Temporary Restraining Order into a Motion for a
Preliminary Injunction. See Order, ECF No. 13. With the parties’ consent, the Court later
modified this order to provide that Ryan Wunderly, a new Treasury employee who will be a
member of the Treasury DOGE Team, may exercise “read only” access to BFS payment records
and systems of records “as needed for the performance of his duties.” Order, ECF No. 32.
Defendants have now had a full opportunity to respond to Plaintiffs’ Motion, and Plaintiffs
have filed a reply in support of the Motion. See Defs.’ Opp’n, ECF No. 24; Pls.’ Reply, ECF No.
28. The Court granted both Plaintiffs and Defendants leave to supplement their submissions to
add declarations that further develop the factual record. See Order, ECF No. 19; Min. Order (Feb.
18, 2025). The Court also called for supplemental memoranda from the parties addressing whether
the Court’s consideration of the Plaintiffs’ Motion should focus on an administrative record. See
Order, ECF No. 27. The Plaintiffs and Defendants each filed supplements in response to this
Order, agreeing that the Court may decide the pending Motion without reviewing an administrative
record. See Defs.’ Mem., ECF No. 29; Pls.’ Mem., ECF No. 31.
The Court held a hearing on Plaintiffs’ Motion on February 24, 2025, at which the parties
presented oral arguments and made additional representations about the factual basis for the
Motion. See generally Feb. 24 Tr., ECF No. 36.
After the hearing, the Court ordered Defendants to “file the administrative record
underlying the decisions challenged in this case on or before March 10, 2025.” Min. Order (Feb.
25, 2025). The Court explained that “binding precedent compels the Court to call for the
administrative record” before ruling on the likelihood of Plaintiffs’ success on the merits of their
APA claims. Id. (citing Am. Bioscience, Inc. v. Thompson, 243 F.3d 579, 582 (D.C. Cir. 2001)).
19 The Court further explained that there was “no impediment to ordering the production of the
administrative record at this stage” because the Court had concluded, for the reasons explained
later in this Memorandum Opinion, that it “has subject-matter jurisdiction over this matter.” Id.
Plaintiffs’ Motion for a Preliminary Injunction is now ripe for decision.
D. Related Proceedings
The parties have alerted the Court to three recent orders in related cases involving BFS and
the Treasury DOGE Team that are pending in other federal district courts. See Pls.’ First Not. of
Suppl. Auth., ECF No. 33; Pls.’ Second Not. of Suppl. Auth., ECF No. 34.
First, Judge Jeannette A. Vargas of the U.S. District Court for the Southern District of New
York has issued a preliminary injunction against multiple defendants, including Secretary Bessent
and the Treasury Department, limiting the Treasury DOGE Team’s access to Treasury payment
records and systems. See New York v. Trump, No. 25-cv-1144-JAV, 2025 WL 573771, at *27
(S.D.N.Y. Feb. 21, 2025). Judge Vargas’s order restrains these defendants from:
granting access to any Treasury Department payment record, payment systems, or any other data systems maintained by the Treasury Department containing personally identifiable information and/or confidential financial information of payees to any employee, officer or contractor employed or affiliated with the United States DOGE Service, DOGE, or the DOGE Team established at the Treasury Department
until further order. Id.
Judge Vargas concluded that the plaintiffs in the case before her were entitled to that relief
because they had shown, among other things, a likelihood of success on the merits of their claim
that “the agency’s processes for permitting the Treasury DOGE Team access to critical BFS
payment systems, with full knowledge of the serious risks that access entailed, was arbitrary and
capricious.” Id. at 50. In support of this conclusion, Judge Vargas noted that “everything about
this process was rushed” and that “[t]he record is silent as to what vetting or security clearance
20 process [Krause and Elez] went through prior to their appointment.” Id. She also noted that the
pace of implementation “left career staff with almost no time to develop their mitigation
measures.” Id. at 51. And she noted with concern the facts that “Elez was mistakenly given
read/write access” to a BFS payment database, that Treasury had not yet determined whether Elez
“emailed . . . confidential information to officials outside the Treasury Department,” and that
Treasury DOGE Team members appear to “take instruction” about some matters from USDS
officials rather than Treasury officials. Id.
Judge Vargas also concluded that the plaintiffs had made a sufficient showing of
irreparable harm to support a preliminary injunction. Id. at 59–60. Specifically, she held that the
plaintiffs had “sufficiently allege[d] irreparable harm from the risk of ‘expanded access’ to the
BFS payment systems that will possibly compromise the systems to become ‘far more vulnerable
to hacking or activities that render the information corrupted or compromised.’” Id. at 59 (quoting
plaintiffs’ brief). Judge Vargas found that these conditions created a “substantial risk of harm”
because “the data access protocols in place do not satisfactorily vet the employees with access and
rigorously train them in data security measures.” Id.
Judge Vargas has ordered the defendants in the case before her to submit a report on or
before March 24, 2025, advising the court of the “training,” “vetting,” and “mitigation” procedures
used to ensure the security of the Treasury DOGE Team’s work, among other matters. Id. This
preliminary injunction remains in effect, and no notice of appeal has yet been filed. See id.
Second, Judge Rossie D. Alston, Jr. of the U.S. District Court for the Eastern District of
Virginia denied a consolidated motion for a temporary restraining order and preliminary injunction
against multiple defendants, including Secretary Bessent and Treasury, that would have limited
the Treasury DOGE Team’s access to Treasury payment records and systems. See Elec. Privacy
21 Info. Ctr. v. U.S. Off. of Pers. Mgmt., 25-cv-0255-RDA/WBP, ECF No. 35 (E.D. Va. Feb. 21,
2025). Judge Alston concluded that the plaintiffs in the case—an unnamed federal employee and
a nonprofit organization suing on behalf of its members—had failed to make a sufficient showing
of irreparable harm to support a temporary restraining order or a preliminary injunction. Id. at 13–
15. Judge Alston concluded that the plaintiffs’ assertions about threatened injuries from improper
disclosures or data breaches involving their personal information were “speculative” and “based
on a series of possibilities, any one of which may never materialize.” Id. at 14.
Third, Judge Deborah L. Boardman of the U.S. District Court for the District of Maryland
denied a motion for a temporary restraining order that would have prevented Secretary Bessent
and Treasury from sharing sensitive personal information with “individuals who are implementing
the President’s DOGE agenda.” See Am. Fed. of Teachers v. Bessent, No. 25-cv-0430-DLB, ECF
No. 38 at 1–2 & n.1 (Feb. 24, 2025). Although Judge Boardman granted similar temporary
restraining orders against other defendants, she declined to do so as to Secretary Bessent and the
Treasury Department because she concluded, in light of Judge Vargas’s preliminary injunction in
the Southern District of New York, that the plaintiffs could not “establish that they would be
irreparably harmed” in the absence of a further temporary restraining order. Id. at 2 n.1.
II. LEGAL STANDARD
“A preliminary injunction is an extraordinary remedy that should be granted only when the
party seeking the relief, by a clear showing, carries the burden of persuasion.” Cobell v. Norton,
391 F.3d 251, 258 (D.C. Cir. 2004). To obtain a preliminary injunction, Plaintiffs must establish
(1) that they are “likely to succeed on the merits,” (2) that they are “likely to suffer irreparable
harm in the absence of preliminary relief,” (3) that “the balance of equities tips in [their] favor,”
and (4) that “an injunction is in the public interest.” Winter v. Nat. Res. Def. Council, Inc., 555
22 U.S. 7, 20 (2008). “[W]hen the Government is the opposing party,” as it is in this case, the balance-
of-equities and public-interest factors “merge,” and courts address those factors together. Nken v.
Holder, 556 U.S. 418, 435 (2009); Singh v. Berger, 56 F.4th 88, 107 (D.C. Cir. 2022).
III. ANALYSIS
A. The Court Has Jurisdiction Over This Case.
Defendants raise two challenges to this Court’s subject-matter jurisdiction in their briefing
on Plaintiffs’ Motion.3 First, they argue that Plaintiffs have not established Article III standing.
Defs.’ Opp’n at 16–20. Second, they contend that Defendants have sovereign immunity against
Plaintiffs’ claims because the Privacy Act and Internal Revenue Code impliedly forbid injunctive
relief under the Administrative Procedure Act and because those statutes provide Plaintiffs with
adequate alternative remedies. Id. at 22–27.
Defendants present these arguments as bases to deny Plaintiffs’ request for a preliminary
injunction. See Defs.’ Opp’n at 16. Because the Court resolves Plaintiffs’ Motion on other
grounds, it does not reach Defendants’ arguments about subject-matter jurisdiction in that context.
But this Court has “an independent obligation to determine whether subject-matter jurisdiction
exists” even before any party has raised a challenge to that jurisdiction. Arbaugh v. Y&H Corp.,
546 U.S. 500, 514 (2006). Accordingly, before turning to Plaintiff’s Motion, the Court begins by
assuring itself of its subject-matter jurisdiction.
For the reasons that follow, the Court concludes that it has subject-matter jurisdiction over
this case.
3 Defendants also raise a third “threshold obstacle to Plaintiffs’ claims.” Defs.’ Opp’n at 16. Namely, Defendants argue that Plaintiffs cannot secure a preliminary injunction under the APA because they do not challenge a final agency action. Id. at 20. And Defendants briefly suggest that without a final agency action, this Court lacks subject- matter jurisdiction. See Defs.’ Mem. at 1. But binding precedent holds that “the APA’s final agency action requirement is not jurisdictional.” Trudeau v. FTC, 456 F.3d 178, 184 (D.C. Cir. 2006). As a result, as Defendants’ counsel agreed during the hearing on Plaintiffs’ Motion, this argument goes to the merits, rather than to the Court’s subject-matter jurisdiction. See Feb. 24 Tr. at 88:9–17. The Court therefore does not reach that argument at this stage.
23 1. Plaintiffs have standing.
Article III of the Constitution confines the federal judicial power to the resolution of
“Cases” and “Controversies.” U.S. Const. art. III, § 2, cl. 1. And the doctrine of “standing is an
essential and unchanging part of the case-or-controversy requirement of Article III.” Lujan v.
Defs. of Wildlife, 504 U.S. 555, 560 (1992). For that reason, deciding that a plaintiff has standing
is a necessary “predicate to any exercise of [the Court’s] jurisdiction.” Fla. Audubon Soc’y v.
Bentsen, 94 F.3d 658, 663 (D.C. Cir. 1996) (en banc).
When an organization seeks to establish standing, it may do so in two ways. It may show
that it has “organizational standing” to sue on its own behalf. FDA v. All. For Hippocratic Med.,
602 U.S. 367, 393 (2024). Or it may demonstrate that it has “associational standing” to sue on
behalf of its members. Sierra Club v. EPA, 754 F.3d 995, 999 (D.C. Cir. 2014). Here, Plaintiffs
assert associational standing. See Pls.’ Reply at 14–20 (discussing harms to “Plaintiffs’
members”); Feb. 24 Tr. at 7:17–23.
To establish associational standing, an organization must show that “(1) its members would
otherwise have standing to sue in their own right; (2) the interests it seeks to protect are germane
to the organization’s purpose; and (3) neither the claim asserted nor the relief requested requires
the participation of individual members in the lawsuit.” Int’l Dark-Sky Ass’n, Inc. v. FCC, 106
F.4th 1206, 1217 (D.C. Cir. 2024) (quoting Ctr. for Sustainable Econ. v. Jewell, 779 F.3d 588, 596
(D.C. Cir. 2015)). Defendants do not dispute the latter two requirements, see Defs.’ Opp’n at 17,
Feb. 24 Tr. at 75:20–78:5, and the Court agrees they are satisfied. The privacy interests of
Plaintiffs’ members are germane to Plaintiffs’ organizational missions.4 And the Court discerns
4 See Fiesta Decl. ¶ 3 (declaring that the “Alliance advocates on behalf of its members . . . on issues such as . . . consumer protection”); Kelley Decl. ¶ 3 (declaring that AFGE “seeks to promote dignity, safety, and fairness for government employees”); Ury Decl. ¶ 3 (declaring that SEIU “advocates on behalf of its members and seeks to improve the lives of workers and their families and to promote an equitable society and economy”).
24 no reason Plaintiffs’ members must participate directly in this case rather than allow their
associations to speak on their behalf.
The associational standing inquiry in this case turns on the first requirement: that Plaintiffs’
members would have standing to sue as individuals. To satisfy that requirement, Plaintiffs must
contend with the familiar three-pronged standing inquiry. That is, each Plaintiff “must show that:
(1) at least one of its members has suffered an injury-in-fact that is concrete and particularized and
actual or imminent, not conjectural or hypothetical; (2) the injury is fairly traceable to the
challenged action; and (3) it is likely, as opposed to merely speculative, that the injury will be
redressed by a favorable decision.” Sierra Club v. FERC, 827 F.3d 59, 65 (D.C. Cir. 2016)
(internal quotation marks omitted) (quoting Friends of the Earth, Inc. v. Laidlaw Env’t Servs., 528
U.S. 167, 180–81 (2000)).
Although the plaintiff “bears the burden of establishing” these three elements, “the manner
and degree of evidence required” to do so varies “at the successive stages of the litigation.” Lujan,
504 U.S. at 561. This Memorandum Opinion follows from Plaintiffs’ Motion for a Preliminary
Injunction, on which Plaintiffs bear the burden of proof. But here, the Court considers only the
threshold question of whether it has subject-matter jurisdiction over this action. And because
Defendants have “not yet filed an answer,” the Court “must evaluate whether [Plaintiffs] have
established standing under the standard applicable pursuant to Federal Rule of Civil Procedure
12(b)(1).” Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 913 (D.C. Cir. 2015).
For that reason, the Court does not assess here whether Plaintiffs have “‘show[n] a
“substantial likelihood” of standing’ ‘under the heightened standard’” applicable on a motion for
a preliminary injunction. Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on Election
Integrity, 878 F.3d 371, 377 (D.C. Cir. 2017) (quoting Food & Water Watch, 808 F.3d at 912–13).
25 But the Court notes that—consistent with that heightened standard—Plaintiffs’ argument for
standing does not “rest on . . . mere allegations” because they have “set forth by affidavit or other
evidence specific facts” that support the existence of a case or controversy. Id. (quoting Lujan,
504 U.S. at 561).
In any event, to satisfy Article III’s case-or-controversy requirement under the 12(b)(1)
standard applicable here, Plaintiffs need only “state a plausible claim” to standing. Humane Soc’y
of the U.S. v. Vilsack, 797 F.3d 4, 8 (D.C. Cir. 2015). When assessing whether Plaintiffs have
cleared this hurdle, the Court “must accept as true all material allegations of the [C]omplaint.”
Warth v. Seldin, 422 U.S. 490, 501 (1972). But the Court is not bound to the Complaint alone.
Rather, “[i]n determining standing,” the Court may also “consider materials outside of the
Complaint.” Food & Water Watch, 808 F.3d at 913.
Further, the Court must “assume [Plaintiffs] will prevail on the merits of their” claims when
evaluating their standing to sue. LaRoque v. Holder, 650 F.3d 777, 785 (D.C. Cir. 2011). That is
particularly so where, as here, Defendants argue that “even assuming” the merits of Plaintiffs’
claims, “Plaintiffs still fail to establish standing.” Defs.’ Opp’n at 18. That defense is a “facial
challenge” to Plaintiffs’ standing. Ranchers-Cattlemen Action Legal Fund v. USDA, 573 F. Supp.
3d 324, 332–33 (D.D.C. 2021) (RDM) (distinguishing facial challenges from factual challenges).
And because Defendants question only the “legal sufficiency” of Plaintiffs’ standing, the Court
need not “go beyond the pleadings [to] resolve . . . disputed issues.” Phoenix Consulting v.
Republic of Angl., 216 F.3d 36, 40 (D.C. Cir. 2000).
Having expounded on the relevant burdens and standards of review, the Court returns to
the elements of the standing analysis. The parties focus their briefing on the first Article III
requirement: that Plaintiffs’ members have “suffered an injury-in-fact that is concrete and
26 particularized and actual or imminent, not conjectural or hypothetical.” Sierra Club, 827 F.3d at
65 (internal quotation marks omitted). Plaintiffs allege their members have suffered one form of
injury: “Defendants have allowed third parties unlawful access to Plaintiffs’ members’ private
information” by failing to comply with the Privacy Act, the Internal Revenue Code, and the
Administrative Procedure Act. Pls.’ Mot. at 21. But an alleged violation of statutory privacy
protections does not complete the injury-in-fact inquiry. Under Article III, “an injury in law is not
an injury in fact.” TransUnion LLC v. Ramirez, 594 U.S. 413, 427 (2021).
“Article III standing requires a concrete injury even in the context of a statutory violation.”
Spokeo, Inc. v. Robins, 578 U.S. 330, 341 (2016). To be “concrete,” an injury must be “real” rather
than “abstract”—that is, “it must actually exist.” Id. A “bare procedural violation” (for example,
failing to publish a notice of a new routine use in the Federal Register) does not qualify as
“concrete” on its own, even if it is directly contrary to law or gives rise to a statutory cause of
action. Id. at 342. The question, then, is “[w]hat makes a harm concrete for purposes of
Article III?” TransUnion, 594 U.S. at 424. To answer that question in a case like this one, which
does not involve an alleged constitutional violation, Plaintiffs must “identif[y] a close historical or
common-law analogue for their asserted injur[ies].” Id.
The Supreme Court illustrated this exercise in analogy in TransUnion LLC v. Ramirez, 594
U.S. 413 (2021). There, a credit reporting agency had erroneously placed alerts in the plaintiffs’
credit files “labeling them as potential terrorists.” Id. at 431. The Supreme Court assumed that
the credit reporting agency’s error “violated its obligations under the Fair Credit Reporting Act”
to maintain accurate information about customers. Id. And the Court analogized the harm
associated with that violation to “the reputational harm associated with the tort of defamation.” Id.
at 432. Although the Court did “not require an exact duplicate” of a defamation claim to support
27 this common-law analogy, it reasoned that “[p]ublication is ‘essential to liability’ in a suit for
defamation.” Id. at 433–34 (quoting Restatement (First) of Torts § 577, cmt. a (Am. L. Inst.
1938)). As a result, it concluded that the plaintiffs whose erroneous “reports were disseminated to
third parties suffered a concrete injury in fact” while the plaintiffs whose erroneous reports were
never shared did not. Id. at 433–35.
Defendants argue that TransUnion dooms Plaintiffs’ standing here. Relying on
TransUnion and other cases discussing the tort of defamation, they contend that, “for Plaintiffs to
establish some concrete harm,” they must show “that the information had been disclosed in a way
that causes them harm, such as a public disclosure.” Defs.’ Opp’n at 18. Because Plaintiffs allege
“(at most) an exchange internal to the federal government,” Defendants argue, Plaintiffs have not
shown the type of public exposure “that causes tangible harm.” Id. at 19.
This argument relies on the premise that the public-vs.-internal distinction in TransUnion
grafts onto this case as a public-vs.-all-of-government distinction. That is not obviously so. After
all, the Privacy Act draws the line between “the agency which maintains” a given record and “any
person” or any “[]other agency.” 5 U.S.C. §§ 552a(b), (b)(1). The privacy interest the statute
creates does not turn on publicity in the traditional sense. Instead, the issue under the Privacy Act
is whether a protected record has been disclosed to anyone outside the relevant agency, even others
in government.
But in any event, Defendants’ publicity argument is fundamentally inapposite. A lack of
public exposure supports an argument that the harm that Plaintiffs describe is not analogous to the
reputational harm caused by defamation. (Indeed, it is only the second-best evidence for that
argument because Plaintiffs have not alleged the most essential element of defamation: a false and
defamatory statement. See Restatement (Second) of Torts § 558 (Am. L. Inst. 1977).) But
28 TransUnion does not require that Plaintiffs’ injury be analogous to defamation or reputational
harm; it requires that Plaintiffs’ injury “has a ‘close relationship’ to a harm ‘traditionally’
recognized as providing a basis for a lawsuit in American courts.” 594 U.S. at 424 (quoting
Spokeo, 578 U.S. at 341).
Here, Plaintiffs have satisfied their burden of showing that their harm has a close
relationship to the harm to privacy vindicated by the common-law tort of intrusion upon seclusion.
TransUnion recognizes that the privacy harm arising from an “intrusion upon seclusion” is an
intangible injury sufficiently “concrete” to satisfy Article III. 594 U.S. at 425. And Courts in this
District and across the country have followed suit when assessing standing.5
At common law, the essential features of intrusion upon seclusion are that the defendant
intentionally intruded “upon the solitude or seclusion of another or his private affairs or concerns”
and that such intrusion “would be highly offensive to a reasonable person.” Restatement (Second)
of Torts § 652B. Crucially, intrusion upon seclusion “does not depend upon any publicity given
to the person whose interest is invaded.” Id. cmt. a. Rather, “[t]he intrusion itself makes the
defendant subject to liability, even though there is no publication.” Id. cmt. b.
Plaintiffs’ alleged injury—the disclosure of their private information to third parties
without a lawful right to access it—bears a close relationship to the harm essential to an intrusion
upon seclusion at common law.
First, the harm Plaintiffs describe involves an intrusion into their members’ “private affairs
or concerns.” Restatement (Second) of Torts § 652B. Courts vary in their assessments of what
5 See, e.g., Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 461–63 (7th Cir. 2020) (Barrett, J.) (holding that a plaintiff’s receipt of unwanted automated text messages was sufficient to confer standing because it was an “intrusive invasion of privacy” with a close relationship to the harm vindicated by intrusion upon seclusion); Dickson v. Direct Energy, LP, 69 F.4th 338, 344–45 (6th Cir. 2023); Lupia v. Medicredit, Inc., 8 F.4th 1184, 1191–92 (10th Cir. 2021); Attias v. CareFirst, Inc., 344 F.R.D. 38, 46 n.2 (D.D.C. 2023) (CRC); Pileggi v. Wash. Newspaper Publ’g Co., No. 23-cv-345, 2024 WL 324121, at *5–8 (D.D.C. Jan. 29, 2024) (BAH).
29 constitutes a private affair or concern within the ambit of intrusion upon seclusion. But one
frequent consideration is whether the plaintiff had a “reasonable expectation of privacy” in the
information or thing intruded upon.6 Here, Plaintiffs’ members have a reasonable expectation that
the records at issue will be private. It is entirely reasonable for those members to rely on the
explicit statutory protections provided by the Privacy Act and the Internal Revenue Code. And
individual members of the Plaintiff organizations aver that they have in fact formed an expectation
that federal agencies will keep their records private. See Rosenblatt Decl. ¶ 10 (“I have trusted the
government to maintain the privacy of my information and to only use my information for lawful
purposes.”); McElhaney Decl. ¶ 10 (same); Casey Decl. ¶ 10 (same).
Moreover, the District of Columbia Court of Appeals has recognized, under D.C. common
law, that “examining a plaintiffs’ private bank account” is one of the “types of invasion intrinsic
in the tort of intrusion upon seclusion.” Wolf v. Regardie, 553 A.3d 1213, 1217–18 (D.C. 1989).
The systems of records at issue in this litigation contain the exact type of private information that
might be found through inspection of an individual’s bank account. System .002 contains the
“routing number” and “account number” of federal payees. 85 Fed. Reg. 11779. System .012
contains information about household “income, assets, [and] liabilities.” Id. at 11794. And System
.013 contains “information about an individual’s bank account(s)” and “credit and debit card
numbers.” Id. at 11796–97.
Here, the intrusion at issue is upon the privacy of information that Plaintiffs have already
turned over to the government. And “there is no liability” for intrusion upon seclusion when the
6 See, e.g., In re Nickelodeon Consumer Priv. Litig., 827 F.3d 262, 294 (3d Cir. 2016) (“Viacom’s promise not to collect ‘ANY personal information’ from children itself created an expectation of privacy . . . .”); Reuber v. Food Chem. News, Inc., 899 F.2d 271, 286 (4th Cir. 1990) (“[T]he jury could have reasonably found that Reuber had a legitimate expectation of privacy in the letter . . . .”); Bogie v. Rosenberg, 705 F.3d 603, 611 (7th Cir. 2013) (“Bogie must therefore establish that a reasonable person could have an expectation of privacy . . . .”).
30 defendant merely examines “a public record concerning the plaintiff” or “documents that the
plaintiff is required to keep and make available for public inspection.” Restatement (Second) of
Torts § 652B cmt. c. But the common law recognizes that, even when the plaintiff has opened his
affairs to some scrutiny, there are still “matters about the plaintiff . . . that are not exhibited to the
public gaze.” Id.
An illustration from the Restatement clarifies the point: A is seeking evidence for a suit
against B; B has disclosed his financial information to a bank; A goes to the bank with a forged
court order and demands access to B’s bank records; when the bank acquiesces to that demand,
“A has invaded B’s privacy.” Id. cmt. b, illus. 4. The fact that B had disclosed his information to
the bank does not defeat A’s liability because B still has a privacy interest in those records vis-à-
vis A. That disclosure is closely analogous to the scenario Plaintiffs have alleged here: Plaintiffs’
members disclosed their information to Treasury; individuals falsely purporting to have lawful
access to that information demanded its disclosure; when Treasury acquiesced to that demand, the
individuals invaded Plaintiffs’ members’ privacy.
Second, the intrusion at issue must be of a kind that “would be highly offensive to a
reasonable person.” Restatement (Second) of Torts § 652B. “The question of what kinds of
conduct will be regarded as a ‘highly offensive’ intrusion is largely a matter of social conventions
and expectations.” J. Thomas McCarthy, The Rights of Publicity and Privacy § 5.1(A)(2) (1993).
But in the District of Columbia at least, the law is clear that:
In this age of identity theft and other wrongful conduct through the unauthorized use of electronically-stored data, . . . conduct giving rise to unauthorized viewing of personal information such as a plaintiff’s Social Security number and other identifying information can constitute an intrusion that is highly offensive to any reasonable person . . . .
Randolph v. ING Life Ins. & Annuity Co., 973 A.2d 702, 710 (D.C. 2009). Plaintiffs allege exactly
this kind of unauthorized viewing. See Compl. ¶¶ 21–23; Pls.’ Mot. at 21. And according to the 31 affidavits submitted by Plaintiffs’ members, this alleged conduct has caused offense and distress.
E.g., Rosenblatt Decl. ¶ 10 (“I am disturbed, anxious, and frustrated that the government violated
my trust . . . .”). That anxiety is reasonable given the sensitivity of the information at issue. And
it is particularly reasonable here because, by Defendants’ own admission, Treasury’s security
measures limiting access to BFS records by the Treasury DOGE Team have proven imperfect. See
Gioeli Decl. ¶ 20 (reporting that BFS’s information-security team “discovered that Mr. Elez’s
database access . . . had mistakenly been configured” to allow “read/write” access to the SPS
database when BFS had intended to grant “read only” access).
At the hearing on Plaintiffs’ Motion, Defendants argued that Plaintiffs’ asserted injury does
not align perfectly with the harm that could be vindicated by a common-law action for intrusion
upon seclusion. See Feb. 24 Tr. at 84:12–85:14. But Article III “does not require an exact duplicate
in American history and tradition.” TransUnion, 594 U.S. at 424. Rather, courts assessing a
plaintiffs’ standing “are meant to look for a ‘close relationship’ in kind, not degree.” Gadelhak,
950 F.3d at 462 (Barrett, J.). Even if Defendants could show that an invasion of Plaintiffs’
members’ privacy interests in the information stored in Treasury’s systems of records would not
be “actionable at common law,” that invasion would still implicate “the same kind of harm that
common law courts recognize.” Id. For that reason, the injury that Plaintiffs allege that their
members face is a concrete injury-in-fact for Article III purposes.
That still leaves the final two prongs of the classic standing analysis: causation and
redressability. As the D.C. Circuit has recognized, the two “‘are closely related,’ like ‘two sides
of a . . . coin.’” West v. Lynch, 845 F.3d 1228, 1235 (D.C. Cir. 2017) (alteration in original)
(quoting Dynalantic Corp. v. Dep’t of Defense, 115 F.3d 1012, 1017 (D.C. Cir. 1997)). Causation
requires “a fairly traceable connection” between the complained-of conduct and the claimed injury.
32 Steel Co. v. Citizens for a Better Env’t, 523 U.S. 83, 103 (1998). And redressability requires “a
likelihood that the requested relief will redress the alleged injury.” Id.
Neither party spills much ink on these requirements. That is understandable. Plaintiffs
allege that their members are injured because they have been deprived of statutory privacy
protections. See Compl. ¶ 40. That alleged injury is fairly traceable to Defendants’ alleged
conduct: granting unauthorized access to Plaintiffs’ members’ protected records without obtaining
their consent or complying with relevant procedures. See id. ¶ 44; Feb. 24 Tr. at 14:12–15:11.
And Plaintiffs’ requested relief—an injunction prohibiting Defendants from continuing to allow
that access—would undoubtedly redress the alleged injury to their members. See Compl. at 18;
Feb. 24 Tr. at 16:2–12.
In sum, the Court concludes that Plaintiffs have adequately alleged that their members
suffered a concrete injury in fact, that this injury is caused by Defendant’s alleged conduct, and
that this injury is redressable through this suit. For that reason, Plaintiffs’ members would have
standing to bring this action in their own right. Because the Court also concludes that the privacy
interest Plaintiffs seek to protect is germane to their organizational purposes and that their
members need not participate in this suit individually, Plaintiffs have associational standing to
bring this suit.
2. Sovereign immunity does not bar this suit.
Defendants’ next jurisdictional argument is that they have immunity from this action.
Absent a waiver, sovereign immunity shields the United States and its officers, agencies, and
instrumentalities from suit. See Loeffler v. Frank, 486 U.S. 549, 554 (1988). That sovereign
immunity is jurisdictional in nature. FDIC v. Meyer, 510 U.S. 471, 475 (1994). And “the terms
of [the United States’s] consent to be sued in any court define that court’s jurisdiction to entertain
33 the suit.” United States v. Sherwood, 312 U.S. 584, 586 (1941). Because each Defendant in this
matter is protected by the aegis of the United States’s sovereign immunity, the Court has subject-
matter jurisdiction over this suit only if Plaintiffs’ claims fall within the scope of a statutory waiver
of that immunity.
Plaintiffs’ Complaint seeks only declaratory and injunctive relief. Compl. at 18.
Therefore, the relevant waiver of sovereign immunity is Section 702 of the Administrative
Procedure Act. See Sea-Land Serv., Inc. v. Alaska R.R., 659 F.2d 243, 244 (D.C. Cir. 1981)
(holding that Section 702 “eliminat[es]” the “sovereign immunity defense in all actions for
specific, nonmonetary relief against a United States agency or officer acting in an official
capacity”). Section 702 provides, in relevant part:
An action in a court of the United States seeking relief other than money damages and stating a claim that an agency or an officer or employee thereof acted or failed to act in an official capacity or under color of legal authority shall not be dismissed nor relief therein be denied on the ground [of sovereign immunity]. . . . Nothing herein . . . confers authority to grant relief if any other statute that grants consent to suit expressly or impliedly forbids the relief which is sought.
5 U.S.C. § 702.
Defendants briefly argue that Congress intended the remedies in the Privacy Act to be
exclusive, impliedly forbidding related forms of relief under the APA. Defs.’ Opp’n at 19–20
(citing Match-E-Be-Nash-She-Wish Band of Pottawatomi Indians v. Patchak, 567 U.S. 209, 215
(2012)). In the decision on which Defendants rely in support of this argument, the Supreme Court
explained that “‘[w]hen Congress has dealt in particularity with a claim and [has] intended a
specified remedy’—including its exceptions—to be exclusive, that is the end of the matter; the
APA does not undo the judgment.” Match-E-Be-Nash-She-Wish Band, 567 U.S. at 216 (second
alteration in original) (quoting Block v. North Dakota ex rel. Board of Univ. and School Lands,
461 U.S. 273, 286 n.22 (1983)).
34 However, the Supreme Court’s more recent decision in Department of Agriculture Rural
Development Rural Housing Service v. Kirtz, 601 U.S. 42 (2024), suggests that the Privacy Act is
not the kind of comprehensive and “exclusive” remedial statute that impliedly displaces related
remedies under other statutes. In Kirtz, the Supreme Court considered whether the Privacy Act’s
remedies for inaccurate agency recordkeeping foreclose a similar remedy under the Fair Credit
Reporting Act (“FCRA”). Id. at 63. The Court concluded that the Privacy Act and FCRA are
“complementary” and that the Privacy Act’s remedial scheme did not evince congressional intent
to forbid the remedy available under FCRA. Id.
Informed by that analysis, this Court concludes that Congress did not intend for the Privacy
Act to be an “exclusive” source of claims or remedies for alleged mishandling of records about
individuals that impliedly forbids other relief under the APA. See Match-E-Be-Nash-She-Wish
Band, 567 U.S. at 216. Therefore, the availability of a Privacy Act suit for damages does not take
this case outside the scope of the waiver of sovereign immunity in § 702 of the APA and does not
affect this Court’s subject-matter jurisdiction over Plaintiffs’ APA claims.
Defendants advance one final, related argument that this Court lacks jurisdiction over
Plaintiffs’ APA claims. See Defs.’ Opp’n at 15–19. That argument proceeds as follows: Section
704 of the APA subjects to judicial review “agency action for which there is no other adequate
remedy in a court.” 5 U.S.C. § 704. The Privacy Act provides for individual damages suits for
“intentional and willful” violations of its provisions. 5 U.S.C. § 552a(g)(1)(D), (g)(4). Similarly,
the Internal Revenue Code provides for “damages against the United States” for improper
inspection or disclosure of tax return information. 26 U.S.C. § 7431(a)–(b). According to
Defendants, damages suits afford an “adequate” remedy for improper disclosures of protected
records about individuals or individuals’ tax return information. See Defs.’ Opp’n at 15–19.
35 Therefore, the argument concludes, injunctive relief is not available under the APA to prevent
improper disclosure of the information at issue. See id.
However, as Defendants conceded during the hearing on Plaintiffs’ Motion, this argument
APA is not jurisdictional. See Feb. 24 Tr. at 92:21–93:8. The D.C. Circuit has held explicitly that
there is “no textual or logical basis for construing § 704—which limits judicial review to ‘final
agency action for which there is no other adequate remedy’—to condition a waiver of sovereign
immunity on the absence of an adequate remedy.” Perry Capital LLC v. Mnuchin, 864 F.3d 591,
621 (D.C. Cir. 2017). Section 704’s adequate-remedy requirement “determine[s] whether there is
a cause of action under the APA, not whether there is federal subject[-]matter jurisdiction.” Id. In
other words, the existence of an adequate remedy under the Privacy Act or the Internal Revenue
Code would not deprive the Court of subject-matter jurisdiction. Because this argument is not
jurisdictional, the Court need not resolve it here at the threshold.
B. Plaintiffs Are Not Entitled to a Preliminary Injunction.
Assured of its jurisdiction, the Court turns to the four-factor Winter test for the issuance of
preliminary injunctive relief. Under this test, Plaintiffs have the burden of establishing that
(1) they are “likely to succeed on the merits,” (2) they are “likely to suffer irreparable harm in the
absence of preliminary relief,” (3) “the balance of equities tips in [their] favor,” and (4) “an
injunction is in the public interest.” Winter, 555 U.S. at 20.
Here, the Court’s analysis of the Winter factors begins and ends with irreparable harm. To
obtain a preliminary injunction, “the movant has the burden to show that all four [Winter] factors,
taken together, weigh in favor of the injunction.” Abdullah v. Obama, 753 F.3d 193, 197 (D.C.
Cir. 2014) (quoting Davis v. Pension Benefit Guar. Corp., 571 F.3d 1288, 1292 (D.C. Cir. 2009)).
However, “the basis of injunctive relief in the federal courts has always been irreparable harm.”
36 Chaplaincy of Full Gospel Churches, 454 F.3d at 297. Therefore, “[a] movant’s failure to show
any irreparable harm is . . . grounds for refusing to issue a preliminary injunction,” regardless of
the strength of the movant’s evidence as to any other factor. Alpine Sec. Corp. v. Fin. Indus. Regul.
Auth., 121 F.4th 1314, 1336 (D.C. Cir. 2024) (quoting Chaplaincy of Full Gospel Churches, 454
F.3d at 297).
Moreover, because a preliminary injunction is “an extraordinary remedy” that is “never
awarded as of right” and that “may only be awarded upon a clear showing that the plaintiff is
entitled to such relief,” courts must not issue such injunctions “based only on a possibility of
irreparable harm.” Winter, 555 U.S. at 22, 24 (emphasis added). Instead, to obtain a preliminary
injunction, the moving party must demonstrate “that irreparable injury is likely in the absence of
an injunction.” Id. at 22 (emphasis in original).
Consistent with these standards, the U.S. Court of Appeals for the D.C. Circuit has “set a
high standard” for the showing of irreparable harm necessary to obtain a preliminary injunction.
Chaplaincy of Full Gospel Churches, 454 F.3d at 297. In this Circuit, the asserted injury offered
to support a preliminary injunction “must be both certain and great.” Wis. Gas Co. v. FERC, 758
F.2d 669, 674 (D.C. Cir. 1985). Accordingly, “[i]njunctive relief ‘will not be granted against
something merely feared as liable to occur at some indefinite time,’” nor will such relief be granted
against an injury that is merely “theoretical.” Id. (quoting Connecticut v. Massachusetts, 282 U.S.
660, 674 (1931)). Instead, “[t]he moving party must show [that] ‘[t]he injury complained of is of
such imminence that there is a “clear and present” need for equitable relief to prevent irreparable
harm.’” Chaplaincy of Full Gospel Churches, 454 F.3d at 297 (alteration in original) (quoting Wis.
Gas Co., 758 F.2d at 674). And as with all elements of the preliminary-injunction standard, the
37 party seeking the injunction “carries the burden of persuasion” in establishing the likelihood of
irreparable harm. Cobell, 391 F.3d at 258.
The standard for irreparable harm in this Circuit appears to be more demanding than that
in the Second Circuit. In the Second Circuit, longstanding precedent holds that a “distinct risk” of
certain harms “may be found to constitute irreparable injury” sufficient to support a preliminary
injunction. See Holt v. Cont’l Grp., Inc., 708 F.2d 87, 91 (2d Cir. 1983); Mullins v. City of New
York, 626 F.3d 47, 55 (2d Cir. 2010). Relying in part on this line of authority, Judge Jeannette A.
Vargas recently concluded that “increased ‘risk’ of negative consequences is sufficient to meet the
irreparable harm requirement for a preliminary injunction” in the Second Circuit. See New York v.
Trump, No. 25-cv-1144-JAV, 2025 WL 573771, at *25 (S.D.N.Y. Feb. 21, 2025) (citing Mullins,
626 F.3d at 55). In the D.C. Circuit, by contrast, an irreparable injury “must be both certain and
great” to support a preliminary injunction. See Wis. Gas Co., 758 F.2d at 674. This Court is
therefore bound not to issue an injunction based on a risk of harm that is only “theoretical.” Id.
In this case, Plaintiffs identify two types of harm that they contend warrant injunctive relief
under the governing standards in this Circuit. However, at this stage, Plaintiffs have not carried
their heavy burden of clearly showing that either asserted harm is an irreparable injury that is both
“certain and great.” See id.
Plaintiffs first assert that Defendants have unlawfully shared their members’ sensitive
information with members of the Treasury DOGE Team without their consent, resulting in an
immediate injury to their legitimate privacy interests. Pls.’ Reply at 8–9. But on the present
record, Plaintiffs have not made a “clear showing” that allowing the Treasury DOGE Team to
access their information is an irreparable harm warranting injunctive relief. See Winter, 555 U.S.
at 22. Although the privacy harms Plaintiffs have asserted are real and sufficiently concrete to
38 support the exercise of this Court’s subject-matter jurisdiction, those asserted harms are not
necessarily “irreparable.” See Cal. Ass’n of Private Postsecondary Schools v. DeVos, 344 F. Supp.
3d 158, 170 (D.D.C. 2018) (RDM) (noting that an injury “sufficient to establish standing . . . does
not necessarily satisfy the more demanding burden of demonstrating irreparable injury”).
As Judge Randolph D. Moss recently observed, courts in this District have consistently
“declined to find irreparable injury” from the disclosure of private information “where the
challenged disclosure is not ‘public,’” but instead is to a small number of “individuals obligated
to keep [the information] confidential.” Univ. of Cal. Student Ass’n v. Carter, No. 25-cv-0354, __
F. Supp. 3d __, 2025 WL 542586, at *5 (D.D.C. Feb. 17, 2025) (RDM).7 Under those
circumstances, a court can fashion “adequate . . . corrective relief” after the fact. See Wis. Gas.
Co., 758 F.2d at 674 (quoting Va. Petroleum Jobbers Ass’n v. FPC, 259 F.2d 921, 925 (D.C. Cir.
1958)). For example, this Court could order the small number of individuals who received the
information to return or destroy it. The “possibility” that adequate relief of that kind “will be
available at a later date, in the ordinary course of litigation[,] weighs heavily against a claim of
irreparable harm.” Id. (quoting Va. Petroleum Jobbers, 259 F.2d at 925).
Plaintiffs also assert that Defendants’ actions “create a nonspeculative risk of dissemination
of private information to additional unauthorized parties” beyond the Treasury DOGE Team. Pls.’
Reply at 10. There is no doubt that public dissemination of sensitive, private information is an
irreparable harm.8 But on the present record, Plaintiffs have not carried their burden of showing
that such dissemination is likely. Instead, the record shows that Defendants have taken measures
7 See also Baker DC v. NLRB, 102 F. Supp. 3d 194, 203 (D.D.C. 2015) (ABJ); Ashland Oil, Inc. v. FTC, 409 F. Supp. 297, 308 (D.D.C. 1976) (HFC), aff’d, 548 F.2d 977 (D.C. Cir. 1976). 8 See, e.g., Hosp. Staffing Sols., LLC v. Reyes, 736 F. Supp. 2d 192, 200 (D.D.C. 2010) (CKK) (concluding that “disclosure of proprietary information” to “competitors in the market” would constitute irreparable harm); Council on Am.-Islamic Rels. v. Gaubatz, 667 F. Supp. 2d 67, 76 (D.D.C. 2009) (CKK) (concluding that public disclosure of confidential information, including “personal information” about a party’s employees, would be irreparable harm).
39 to monitor and control the Treasury DOGE Team’s access to BFS systems and limit the risk of
improper disclosure outside the agency. See, e.g., Gioeli Decl. ¶¶ 12–15. Defendants’ counsel
represented at the hearing on Plaintiffs’ Motion that these measures will remain in place going
forward. Feb. 24 Tr. 113:12–114:14. Meanwhile, Plaintiffs have not shown that any improper
disclosure of private information outside the federal government has taken place or that any such
dissemination is planned in the future. See Gioeli Decl. ¶ 21. The record does show that BFS
made mistakes while onboarding the Treasury DOGE Team: For example, it improperly granted
Elez “read/write” access to the SPS database for a brief period, and it failed to process Krause’s
appointment paperwork accurately and in a timely manner. Id. ¶ 20; Wenzler Decl. ¶ 5. However,
there is no direct evidence that any of these mistakes resulted in improper disclosure outside of the
federal government or made such disclosure more likely in the future. See Gioeli Decl. ¶ 21.
Therefore, these mistakes do not, without more, show that improper dissemination of private
information obtained from BFS systems is likely in the future.
During the hearing on their Motion, Plaintiffs argued that certain language in the
President’s Executive Order reorganizing the USDS supports an inference that Defendants will
make improper disclosures of sensitive records in the absence of an injunction from this Court.
See Feb. 24 Tr. at 46:2–14. In relevant part, that Executive Order directs the heads of federal
agencies to:
take all necessary steps, in coordination with the USDS Administrator and to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.
Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 20, 2025) § 4(b). Plaintiffs argue that this
language shows that Defendants are “going to share data [with USDS] as soon as the courts allow
them to,” causing their members an irreparable loss of privacy. Feb. 24 Tr. at 46:10–17.
40 However, Defendants’ counsel represented to the Court that Defendants interpret the
Executive Order to require agencies like Treasury to share information with USDS only if that
sharing is “consistent with,” among other sources of law, the Privacy Act and the Internal Revenue
Code. Id. at 117:9–17. Defendants’ counsel further represented that, in the absence of a court
order, Defendants “would not share information with USDS unless it were authorized by the
Privacy Act or the Internal Revenue Code.” Id. at 118:7–10. Because Plaintiffs have not produced
any evidence to rebut this representation, they have not shown that unlawful dissemination of their
members’ private information is likely in the absence of a preliminary injunction.
Plaintiffs’ inability to show a likelihood of future wrongful dissemination of their
members’ private information is fatal to their Motion. Under the law of this Circuit, an increased
risk of future harm, however grave that harm may be, is not sufficient to support a preliminary
injunction in the absence of a showing that the threatened harm is likely to materialize.9 Therefore,
merely asserting that the Treasury DOGE Team’s operations increase the risk of a catastrophic
data breach or public disclosure of sensitive information from BFS systems is not sufficient to
support a preliminary injunction. Instead, Plaintiffs have the heavy burden of demonstrating that
such a breach or improper disclosure is “likely in the absence of an injunction.” Winter, 555 U.S.
at 22 (emphasis in original). On the present record, Plaintiffs have not carried this burden.
9 See, e.g., Standing Rock Sioux Tribe v. U.S. Army Corps of Eng’rs, 205 F. Supp. 3d 4, 33–34 (D.D.C. 2016) (JEB) (concluding that Tribes were not entitled to a preliminary injunction against permitting of oil pipeline operations, in part because they had not shown that resulting harm to “sites of great cultural or historical significance” was “probable,” even though that harm would be “significant”); Sierra Club v. United States Army Corps of Eng’rs, 990 F. Supp. 2d 9, 41 (D.D.C. 2013) (KBJ) (concluding that even “fearsome” harms from a potential future oil spill did not support the issuance of a preliminary injunction against permitting of an oil pipeline where the plaintiffs had not “shown that a damaging oil spill [was] likely” (emphasis in original)); Nat. Res. Def. Council v. Kempthorne, 525 F. Supp. 2d 115, 126 (D.D.C. 2007) (concluding that the potential for gas drilling operations to cause methane seeps that may kill or injure people did not warrant preliminary injunction in the absence of evidence that such harms were “likely”); see also Standing Rock Sioux Tribe v. U.S. Army Corps of Eng’rs, 540 F. Supp. 3d 45, 57 (D.D.C. 2021) (JEB) (concluding, under the related standard for the issuance of a permanent injunction, that the threat of an oil spill into water used “for drinking, industry, and sacred practices” was not sufficient to support injunctive relief against operation of an oil pipeline without a showing that a spill was “likely,” rather than merely “possible”).
41 Similarly, in the absence of a showing that irreparable harm from improper disclosure is
likely, Plaintiffs’ evidence that their members are suffering and will continue to suffer emotional
distress because of Defendants’ actions is not sufficient to support a preliminary injunction. See,
e.g., Rosenblatt Decl., ¶¶ 7–10; McElhaney Decl., ¶¶ 7–10; Casey Decl. ¶¶ 7–10; Jenkins Decl.,
¶¶ 7–10; Morrison Decl., ¶¶ 5–8; Peterson Decl., ¶¶ 6–9; Tousignant Decl., ¶¶ 6–9. The Court
does not doubt the sincerity of Plaintiffs’ members’ understandable distress. But in this Circuit,
emotional distress, no matter how sincere, cannot support a preliminary injunction without a
showing that the feared event giving rise to that distress is likely to occur. See, e.g., Standing
Rock, 540 F. Supp. 3d at 63; Sierra Club, 990 F. Supp. 3d at 41 & n.18.
On this point, now-Chief Judge James E. Boasberg’s decision in Standing Rock Sioux
Tribe v. United States Army Corps of Engineers, 540 F. Supp. 3d 45 (D.D.C. 2021), is instructive.
There, a group of sovereign American Indian Tribes had sued to halt the construction and operation
of the Dakota Access Pipeline, which they argued threatened a vital source of drinking water for
the Tribes on land that historically belonged to the Standing Rock Sioux Tribe and the Cheyenne
River Sioux Tribe. See id. at 51. Chief Judge Boasberg ultimately agreed with the Tribes on one
of their legal challenges to the pipeline project, concluding that the pipeline had unlawfully
encroached on federal land. Id. at 49. Nonetheless, he declined to issue a permanent injunction
against the pipeline’s operation because he concluded that the Tribes had not carried their burden
of showing a likely, irreparable injury under the law of this Circuit. Id. at 64. In reaching this
conclusion, Chief Judge Boasberg considered the argument that Tribe Members’ sincere “anxiety
and trauma” that would result from the contemplation of “a hypothetical damaging oil spill” on
sacred land might be an “irreparable injury” unto itself, regardless of the measurable risk of such
a spill. Id. at 62–63. He rejected that argument, reasoning that “when the risk of the feared harm
42 from the agency action in question is ‘low,’ plaintiffs cannot claim irreparable injury from any
‘emotional distress’ surrounding the prospect of that speculative harm.” Id. at 63 (quoting Colo.
Wild Horse v. Jewell, 130 F. Supp. 3d 205, 220 (D.D.C. 2015) (CRC)).
The same reasoning precludes the issuance of a preliminary injunction based on Plaintiffs’
members’ emotional distress in this case. Because Plaintiffs have not carried their burden of
showing that improper dissemination of their private information is likely in the absence of an
injunction, the emotional distress they may endure as a result of exposure to that risk—no matter
how sincere—does not provide a basis for injunctive relief. See Standing Rock, 540 F. Supp. 3d
at 63; Sierra Club, 990 F. Supp. 3d at 41 & n.18; Colo. Wild Horse, 130 F. Supp. 3d at 220.
Finally, the Court briefly addresses one theory on which it does not rely in concluding that
Plaintiffs have not made the required showing of irreparable harm. Parties sometimes argue that
an injunction is not necessary to prevent irreparable harm because another district court has already
issued an injunction covering similar subject matter. However, this Court agrees with the many
others that “routinely grant follow-on injunctions against the Government, even in instances when
an earlier nationwide injunction has already provided plaintiffs in the later action with their desired
relief.” Whitman-Walker Clinic, Inc. v. U.S. Dep’t of Health & Hum. Servs., 485 F. Supp. 3d 1,
60 (D.D.C. 2020) (JEB) (collecting cases). As Plaintiffs correctly noted during the hearing on
their Motion, a prior injunction may later be appealed or modified, so the existence of such an
injunction is not necessarily adequate to protect the interests of other parties. See Feb. 24 Tr. at
6:3–20. Accordingly, this Court has assessed Plaintiffs’ evidence of irreparable harm independent
of the preliminary injunction that Judge Vargas issued in the Southern District of New York, and
its conclusion does not depend on the existence of that injunction.
43 In sum, at this stage, Plaintiffs’ Motion falls short of the standard for issuance of a
preliminary injunction in this Circuit, which forbids courts from awarding that relief in the absence
of evidence of an injury that is “both certain and great.” Wis. Gas Co. v. FERC, 758 F.2d at 674;
see also Winter, 555 U.S. at 22 (holding that courts may not award the “extraordinary” remedy of
a preliminary injunction “based only on a possibility of irreparable harm”). Courts in this Circuit
“must faithfully and fairly apply that standard in all cases, regardless of how high the stakes or
how worthy the cause.” Standing Rock Sioux Tribe, 205 F. Supp. 3d at 34. This Court must
therefore deny Plaintiffs’ Motion.
If Plaintiffs could show that Defendants imminently planned to make their private
information public or to share that information with individuals outside the federal government
with no obligation to maintain its confidentiality, the Court would not hesitate to find a likelihood
of irreparable harm. But on the present record, Plaintiffs have not shown that Defendants have
such a plan. If circumstances change, Plaintiffs are free to return to federal court to seek any proper
emergency remedy. Accord, e.g., Am. For. Serv. Ass’n v. Trump, 25-cv-0352, ECF No. 49 at 14
n.2 (D.D.C. Feb. 21, 2025) (CJN). Nothing in today’s opinion should be understood to foreclose
or in any way prejudge any future request for such relief.
IV. CONCLUSION
For the foregoing reasons, the Court shall DENY Plaintiffs’ [8] Motion for a Preliminary
Injunction. An appropriate Order accompanies this Memorandum Opinion.
DATED: March 7, 2025
COLLEEN KOLLAR-KOTELLY United States District Judge
Related
Cite This Page — Counsel Stack
Alliance for Retired Americans v. Bessent, Counsel Stack Legal Research, https://law.counselstack.com/opinion/alliance-for-retired-americans-v-bessent-dcd-2025.