American Federation of Labor and Congress of Industrial Organizations v. Department of Labor

Opinion

UNITED STATES DISTRICT COURT FOR THE DISTRICT OF COLUMBIA

AMERICAN FEDERATION OF LABOR AND CONGRESS OF INDUSTRIAL ORGANIZATIONS, et al.,

Plaintiffs, v. Civil Action No. 25-339 (JDB)

DEPARTMENT OF LABOR, et al.,

Defendants.

MEMORANDUM OPINION AND ORDER Soon after President Trump issued Executive Order 14158, creating the United States DOGE Service, individuals at the Department of Labor (“DOL”) and the Department of Health and Human Services (“HHS”) began pursuing the “DOGE Agenda” by “modernizing Federal technology and software to maximize governmental efficiency and productivity.” See 90 Fed. Reg. 8441 § 1 (Jan. 20, 2025) (“E.O.”). That pursuit included seeking and gaining access to data systems that hold caches of Americans’ personal information, including medical files, financial histories, social security numbers (“SSNs”), addresses, and more. Yet the agencies did not notify any American that the individuals working on the DOGE Agenda—whom the Court will call DOGE Affiliates—were viewing their information.

As a result, a host of unions and nonprofits sued, alleging among other things that the agencies are violating the Privacy Act of 1974 by granting DOGE Affiliates access to their members’ data without consent. The Court has thus far denied plaintiffs’ two motions for temporary restraining orders (“TROs”), notwithstanding its concerns about DOGE Affiliates’

2

access to a stockpile of extremely sensitive information. Now, after the benefit of expedited discovery, plaintiffs move for a preliminary injunction.

The Court, however, still cannot step in. The only harm plaintiffs allege their members face is that their information has been or will be viewed by unauthorized government personnel. Absent evidence those personnel will imminently misuse or publicly disclose that information, the Court cannot say that irreparable harm will clearly occur before the Court can make a final determination on the merits. This conclusion does not mean the harm the members face is insubstantial or that the Court harbors no concerns that DOGE Affiliates have their hands on some of the most personal information individuals entrust to the government. To the contrary, the Court’s concerns are as grave as ever, and it stands ready to remedy plaintiffs’ harm should they ultimately succeed on the merits. At this time, however, the extraordinary remedy of a preliminary injunction is not warranted.

BACKGROUND

Despite its preliminary posture, this litigation has amassed an extensive procedural history.

The impetus for the case, Executive Order 14158, was one of the many executive orders President Trump issued on the day of his second inauguration. That order renamed the United States Digital Service as the United States DOGE Service (“USDS”), reorganized it within the Executive Office of the President, and created the U.S. DOGE Service Temporary Organization. E.O. § 3. These organizations, to which the Court will refer under the umbrella term of USDS, are tasked with “modernizing Federal technology and software to maximize governmental efficiency and productivity.” Id. § 1. To aid in this mission, the order directed all federal agency heads to promptly “establish within their respective Agencies a DOGE Team of at least four employees” that will “coordinate [its] work with USDS” and provide the agency head advice on how to

3

“implement[] the President’s DOGE Agenda.” Id. § 3(c). In conjunction, the order required each agency head to “take all necessary steps, . . . to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.” Id. § 4(b).

On February 5, 2025, plaintiffs sued DOL and USDS and moved for a TRO. Compl. [ECF No. 1]; Mot. TRO [ECF No. 2] (“First TRO Mot.”). Plaintiffs explained that USDS was on the precipice of “enter[ing] . . . the Department of Labor and attempt[ing] to gain access to sensitive systems” that contain “data of millions of Americans and many federal employees,” all allegedly in violation of laws such as the Privacy Act. First TRO Mot. at 19. It turned out plaintiffs were right, at least as to timing: DOL confirmed on a call with the Court that the agency was meeting with USDS staff that very day. On that same call, however, DOL assured the Court that it would not permit USDS personnel to access DOL systems until after the Court ruled on the TRO motion. See Order [ECF No. 5] at 1. Days later, the Court denied the motion because plaintiffs had failed to establish a substantial likelihood of standing: they had put forward no evidence that specific members would be harmed (so as to support associational standing), nor any evidence that the organizations themselves had standing in their own right (so as to support organizational standing). See Am. Fed. of Labor & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO I”), 766 F. Supp. 3d 32, 37–39 (D.D.C. 2025).

In reaction, plaintiffs filed an amended complaint—that added as defendants HHS and the Consumer Financial Protection Bureau (“CFPB”)—and a second motion for a TRO. Am. Compl. [ECF No. 21]; Mot. TRO [ECF No. 29]. Along with their opposition to the renewed TRO motion, defendants filed three affidavits that confirmed that DOGE Affiliates—whether directly hired by the agency defendants or detailed to the agencies from USDS or another agency—were working

4

at each agency and either had been or would likely be granted access to sensitive agency systems of records. See Decl. of Ricky J. Kryger [ECF No. 31-1] (DOL); Decl. of Garey Rice [ECF No. 31-2] (HHS); Decl. of Adam Martinez [ECF No. 31-3] (CFPB).

Despite this information, the Court denied plaintiffs’ renewed TRO motion. The Privacy Act prohibits an agency from disclosing without an individual’s written consent “any record”1 of that individual “which is contained in a system of records by any means of communication to any person, or to another agency.” 5 U.S.C. § 552a(b). Yet it permits an agency to disclose said records to “employees of the agency . . . who have a need for the record in the performance of their duties.” § 552a(b)(1).2 The Court determined that, on the record as it stood, plaintiffs had failed to establish that it was likely the DOGE Affiliates were not “employees of the agency” with a “need for the record[s].” See Am. Fed. of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL- CIO II”), 766 F. Supp. 3d 105, 111 (D.D.C. 2025).

Soon thereafter, plaintiffs moved for, and the Court granted, limited expedited discovery focused on irreparable harm. See Pls.’ Mot. Expedited Disc. [ECF No. 44]; Am. Fed. of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO III”), Civ. A. No. 25-339 (JDB), 2025 WL 1142495, at *4 (D.D.C. Feb. 27, 2025). Plaintiffs’ alleged irreparable harm, the Court explained, rests on their Privacy Act claim, so determining whether DOGE Affiliates are employees of the relevant agency with a need for the records is critical. AFL-CIO III, 2025 WL 1142495, at *4. And the Court affirmed the grant of limited expedited discovery even though defendants later

1 The Privacy Act defines “record” to mean “any item, collection, or grouping of information about an individual that is maintained by an agency, including, but not limited to, his education, financial transactions, medical history, and criminal or employment history and that contains his name, or the identifying number, symbol, or other identifying particular assigned to the individual, such as a finger or voice print or a photograph.” § 552a(a)(4). The Court uses “record” in that way throughout this Opinion.

2 This is one of many exceptions to the Privacy Act’s written-consent requirement, see 5 U.S.C. § 552a(b)(2)– (13), but is the only exception defendants argue applies here.

5

submitted evidence that no DOGE Affiliates working at the agency defendants are currently detailed from USDS. The question whether the record disclosures fall within § 552a(b)(1), the Court reasoned, remains open even if the Affiliates are direct hires of the agency defendants or detailees from other agencies. See Am. Fed. of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO IV”), Civ. A. No. 25-339 (JDB), 2025 WL 1129202, at *5–6 (D.D.C. Mar. 19, 2025).

After discovery wrapped up, the Court granted in part and denied in part defendants’

motion to dismiss the amended complaint. As relevant here, the Court concluded that plaintiffs had adequately alleged (1) associational standing to sue HHS and DOL, because their members’ alleged Privacy Act harm is akin to the harm that supports the common-law torts of intrusion upon seclusion and breach of confidence; and (2) claims under the Administrative Procedure Act (“APA”) that the agencies’ so-called DOGE Access Polices—i.e., their decisions to give allegedly unauthorized systems access to DOGE Affiliates—violate the Privacy Act. See Am. Fed. of Lab. & Cong. of Indus. Orgs. v. Dep’t of Lab. (“AFL-CIO V”), Civ. A. No. 25-339 (JDB), 2025 WL 1129227, at *5–18 (D.D.C. Apr. 16, 2025).

With their APA claims alive and well—and armed with discovery—plaintiffs filed the instant preliminary injunction motion. Pls.’ Mot. Prelim. Inj. [ECF No. 80]; Pls.’ Mem. Supp. Mot. Prelim. Inj. [ECF No. 80-1] (“Mot.”). Plaintiffs seek to enjoin DOL and HHS (but not CFPB) from, among other things, providing DOGE Affiliates access to sensitive systems.3 Neither side has yet sought summary judgment.

ANALYSIS

3 The Court notes at the outset that the Supreme Court recently granted the government’s application for a stay of a district court’s preliminary injunction order in another case challenging under the APA and the Privacy Act USDS’s access to agency records systems. See Soc. Sec. Admin. v. Am. Fed’n of State, Cnty., & Mun. Emps. (“AFSCME”), 145 S.Ct. 1626 (2025) (mem.). The Supreme Court, however, did not say why it granted the stay. While the Supreme Court’s order thus cannot meaningfully inform—let alone dictate—this Court’s reasoning and ruling here, this Court is all the more confident in its denial of plaintiffs’ motion because it is at least broadly consistent with the Supreme Court’s stay.

6

I. Standing “The threshold question is whether the plaintiffs have standing to sue under Article III of the Constitution.” FDA v. All. for Hippocratic Med., 602 U.S. 367, 378 (2024). Standing requires at least one plaintiff to establish three “well-known and firmly rooted” elements: “(i) that she has suffered or likely will suffer an injury in fact, (ii) that the injury likely was caused or will be caused by the defendant, and (iii) that the injury likely would be redressed by the requested judicial relief.” Id. What it takes to satisfy standing depends on the stage of the litigation. TransUnion LLC v. Ramirez, 594 U.S. 413, 431 (2021). On a preliminary injunction motion, a plaintiff must put forward evidence that “show[s] a substantial likelihood of standing.” See Elec. Priv. Info. Ctr. v. Presidential Advisory Comm’n on Election Integrity, 878 F.3d 371, 377 (D.C. Cir. 2017) (cleaned up). This is because a court needs more than mere allegations of its constitutional authority before granting the “extraordinary and drastic remedy” of imposing obligations on a party before a claim is fully litigated. See Hosp. for Special Surgery v. Becerra, Civ. A. No. 22-2928 (JDB), 2023 WL 6291638, at *3 (D.D.C. May 31, 2023) (cleaned up). In assessing standing, the Court must assume a plaintiff will succeed on the merits. Comm. on Judiciary of U.S. House of Representatives v. McGahn, 968 F.3d 755, 762 (D.C. Cir. 2020).

While plaintiffs—all organizations—have two routes for demonstrating standing, see Food & Water Watch, Inc. v. Vilsack, 808 F.3d 905, 914, 919 (D.C. Cir. 2015), here they focus exclusively on associational standing. So they must establish an additional trio of requirements: “(1) at least one of the association’s members would have standing in her own right, (2) the interests that the association seeks to protect in the lawsuit are germane to the association's purposes, and (3) the claims the association asserts and relief it requests don’t require individual-

7

member participation.” AFL-CIO V, 2025 WL 1129227, at *6 (citing Sierra Club v. EPA, 754 F.3d 995, 999 (D.C. Cir. 2014)).

As previously mentioned, the Court in its motion to dismiss opinion determined that plaintiffs had adequately alleged that at least one plaintiff had associational standing to sue DOL and HHS. Id. This determination was rooted in a key legal holding: the privacy harm that results from disclosure—and disclosure alone—of records in violation of the Privacy Act is sufficiently akin to the harm suffered in the common-law tort of intrusion upon seclusion to constitute a concrete injury in fact.4 Id.

Defendants ask the Court to rethink that holding. See Defs.’ Opp’n Pls.’ Mot. Prelim. Inj.

[ECF No. 82] (“Opp’n”) at 27–31. “A district court may reconsider an interlocutory order ‘as justice requires.’” TIG Ins. Co. v. Republic of Argentina, Misc. A. No. 18-129 (DLF), 2023 WL 11992311, at *1 (D.D.C. Feb. 10, 2023), aff’d, 110 F.4th 221 (D.C. Cir. 2024) (quoting Capitol Sprinkler Inspection, Inc. v. Guest Servs., Inc., 630 F.3d 217, 227 (D.C. Cir. 2011)), aff’d, 110 F.4th 221 (D.C. Cir. 2024). Typically, a court will reassess a prior holding only if there has been an “intervening change in the law,” previously unavailable facts were discovered, or the first order was “a clear error.” Parker v. John Moriarty & Assocs., 221 F. Supp. 3d 1, 2 (D.D.C. 2016). In short, a “court is loath to revisit its prior decision absent extraordinary circumstances.” TIG Ins.

4 The Court also held that the members’ harm is analogous to the harm suffered in the tort of breach of confidence, which “lies where a person offers private information to a third party in confidence and the third party reveals that information to another.” AFL-CIO V, 2025 WL 1129227, *9 (quoting Jeffries v. Volume Servs. Am., Inc., 928 F.3d 1059, 1064 (D.C. Cir. 2019)). The harm in that tort is simply the “plaintiff’s trust in the breaching party [being] violated.” Id. (quoting Jeffries, 928 F.3d at 1064). Defendants challenge this holding too, but more cursorily: they say the holding fails because “[p]laintiffs provide no examples of the tort being applied to intragovernmental disclosures of the sort at issue here.” Opp’n at 31. As the Court will explain soon, no such twin is needed for a court to determine a harm is analogous to a common-law harm. See TransUnion, 594 U.S. at 433. So the Court remains steadfast in its alternative holding that the harm plaintiffs’ members are suffering is concrete because it is analogous to the harm that supports a breach of confidence claim.

8

Co., 2023 WL 11992311, at *1 (quoting Hall & Assocs. v. EPA, 210 F. Supp. 3d 13, 18 (D.D.C. 2016)).

No such extraordinary circumstance exists here. To start, defendants (rightly) do not contend that there has been any relevant change in law in the past two months. Rather, they rely largely on the same legal arguments they raised in their motion to dismiss, but now bolstered by additional citations. Compare Defs.’ Mem. of L. Supp. Mot. Dismiss [ECF No. 49-1] at 13–16, with Opp’n at 27–31.5 Those added citations—which defendants could have included in their motion to dismiss papers—give the Court no reason to reconsider its prior rejection of defendants’ arguments. See Davis v. Joseph J. Magnolia, Inc., 893 F. Supp. 2d 165, 168 (D.D.C. 2012) (noting a court will not reconsider an issue merely because a party “present[s] theories or arguments that could have been advanced earlier”).

Nor has there been a relevant change of fact, for there couldn’t have been. The Court’s holding that the privacy harm caused by an alleged Privacy Act violation is a concrete injury in fact was just that: a legal determination, not a factual one. So while facts elucidated in discovery could show that plaintiffs’ members are not actually or imminently suffering such a harm, or that this harm was not caused by defendants, those facts don’t affect the Court’s conclusion that the harm constitutes an injury in fact. But see Opp’n at 27–31 (suggesting that discovery has revealed facts that undermine the Court’s holding).

5 As previously mentioned, the Supreme Court’s order granting the government’s stay application in AFSCME did not explain why the stay was warranted. See 145 S.Ct. 1626. The Court cannot simply assume that the Court agreed with the government’s standing argument—which was one of several grounds for a stay the application asserted. See generally Appl. Stay, Appl. for Stay of Inj. at 19, Social Sec. Admin. v. AFSCME, AFL-CIO, No. 24A1063 (U.S. May 2, 2025).

9

Lastly, the Court’s prior holding was not clearly erroneous. To the contrary, the Court remains confident that its holding—and the holding of three other district courts6—is correct. A short recap of the reasoning that backed the Court’s holding shows why.

Start from the recognition that a plaintiff does not have an injury in fact just because she has a cause of action to sue for the defendant’s legal violation. TransUnion, 594 U.S. at 428. So plaintiffs here cannot rest on the alleged Privacy Act violation alone. Rather, they must show that the alleged violation is causing at least one of their members concrete harm. See id. at 426. The harm plaintiffs assert their members are suffering is an invasion of their privacy caused by DOGE Affiliates simply viewing their information.7 Such an intangible harm is concrete only if it bears a “close relationship to a harm traditionally recognized as providing a basis for a lawsuit in American courts.” Id. at 440. In other words, the harm caused by a violation of § 552a(b) must have a “common-law analogue.” See id. at 424.

That brings us to the common-law tort of intrusion upon seclusion: one is liable if one “intentionally intrudes, physically or otherwise, upon the solitude or seclusion of another or his private affairs or concerns . . . if the intrusion would be highly offensive to a reasonable person.” Restatement (Second) of Torts § 652B. Some examples include “‘physical intrusion into . . . the plaintiff’s room in a hotel’ or his home; ‘use of the defendant’s senses . . . to oversee or overhear the plaintiff’s private affairs’; and ‘opening [the plaintiff’s] private and personal mail [or]

6 All. for Retired Ams. v. Bessent, 770 F. Supp. 3d 79, 101–02 (D.D.C. 2025); Am. Fed. of Tchrs. v. Bessent, Civ. A. No. 25-430 (DLB), 2025 WL 895326, at *7–13 (D. Md. Mar. 24, 2025); Am. Fed. of State, Cnty. & Mun. Emps. (“AFSCME”), AFL-CIO v. Social Sec. Admin., Civ. A. No. 25-596 (ELH), 2025 WL 868953, at *35–43 (D. Md. Mar. 20, 2025). No Court of Appeals has affirmatively ruled on this issue, although the Fourth Circuit, through orders granting a stay of one preliminary injunction and denying a stay of another, has discussed it extensively (without consensus). See Am. Fed. of Tchrs. v. Bessent, No. 25-1282, 2025 WL 1023638 (4th Cir. Apr. 7, 2025); AFSCME v. Social Sec’y Admin., No. 25-411, 2025 WL 1249608 (4th Cir. Apr. 30, 2025).

7 Shortly, the Court will discuss whether plaintiffs have sufficiently shown a substantial likelihood that at least one specific member is suffering such a privacy harm caused by each defendant.

10

searching his safe or his wallet.’” Appl. for Stay of Inj. at 19, Social Sec. Admin. v. Am. Fed. of State, Cnty. & Mun. Emps. (“AFSCME”), AFL-CIO, No. 24A1063 (U.S. May 2, 2025) (alterations in original) (quoting Restatement (Second) of Torts § 652B(b)). The harm that supports an action for this tort is the intrusion alone; no knock-on harm—monetary, reputational, or otherwise—is necessary. Restatement (Second) of Torts § 652B cmt. b.8 So, for example, a plaintiff who sues someone for searching through his mail need not show that the snooper later published the information the mail held. Id.

The privacy harm plaintiffs assert here tracks nicely onto this harm. They allege that the DOGE Affiliates, much like a window peeper or mail snoop, are peering into their members’ personal affairs by viewing their confidential records without authorization. Nothing more is needed.

Defendants disagree. In their view, a close relationship with the harm asserted in an intrusion upon seclusion claim requires the harm to be “highly offensive to an ordinary, reasonable person.” Opp’n at 30. And, defendants say, viewing one’s records does not rise to that level.

Even assuming defendants are right that a reasonable person wouldn’t find it highly offensive for an unauthorized person to view their medical, financial, and other records, there are two issues with this argument. First, it misunderstands TransUnion. An intangible harm needn’t be “an exact duplicate” of the harm needed to prevail on the relevant common-law tort claim. See TransUnion, 594 U.S. at 433; Gadelhak v. AT&T Servs., Inc., 950 F.3d 458, 462 (7th Cir. 2020) (Barrett, J.). It just needs to “bear[] a sufficiently close relationship” to the harm that permits a plaintiff to sue for that tort. TransUnion, 594 U.S. at 433.

8 Plaintiffs do not allege (nor does the record show) their members face any knock-on harms from DOGE Affiliates’ access.

11

A good example of what it takes for a relationship to be “sufficiently close” comes from a case that both the Supreme Court in TransUnion and defendants here cite: Gadelhak. There, one issue was whether plaintiffs had standing to sue for a violation of the Telephone Consumer Protection Act, which prohibits certain forms of telemarketing. 950 F.3d at 460; see also 47 U.S.C. § 227(b)(1). The plaintiff’s asserted injury was that he received five text messages even though he was on the “Do Not Call Registry.” Gadelhak, 950 F.3d at 460. Writing for a unanimous three- judge panel of the Seventh Circuit, then-Judge Barrett determined that this harm was sufficiently similar to the harm asserted in an intrusion upon seclusion claim. Id. at 462. It did not matter that Gadelhak had received only five text messages when liability for an intrusion upon seclusion claim “generally require[s] a much more substantial imposition—typically, many calls.” Id. Determining whether a harm is concrete is a matter of analogy: a court “look[s] for a close relationship” to a traditional harm “in kind, not degree.” Id. (cleaned up). And the harm Gadelhak suffered by the texts intruding upon his solitude was sufficiently analogous. Id.; see also TransUnion, 594 U.S. at 425 (citing Gadelhak for the proposition that intrusion upon seclusion can serve as a common-law analogue). This is despite the unlikelihood that a reasonable person would find five text messages “highly offensive,” let alone more offensive than viewing one’s medical records. But see Opp’n at 30.

Gadelhak also tees up the second issue with defendant’s argument, which is that Congress enacted the Privacy Act to prevent agencies from invading individuals’ privacy. See Doe v. Chao, 540 U.S. 614, 618 (2004). Congress is always able to “elevate to the status of legally cognizable concrete, de facto injuries previously inadequate in law.” See TransUnion, 594 U.S. at 425 (quoting Spokeo, Inc. v. Robins, 578 U. S. 330, 341 (2016)). In Congress’s view, a disclosure of records to an unauthorized person invades “the privacy of individuals identified in information

12

systems maintained by Federal agencies.”9 Doe, 540 U.S. at 618; accord Spokeo, 578 U.S. at 341 (“Congress is well positioned to identify intangible harms that meet minimum Article III requirements . . . .”). Because this invasion is analogous to the harm that supports an intrusion upon seclusion claim against other types of snoopers, Congress “elevated” it to the status of cognizable—even though a plaintiff who tried to bring a common-law tort claim based on that sort of invasion might lose. Put differently, “Congress identified a modern relative of a harm with long common law roots.” Gadelhak, 950 F.3d at 462.

In sum, the Court stands by its previous holding that the harm that results from mere viewing of records in violation of § 552a(b) is a concrete harm and thus a cognizable injury in fact.10 Defendants’ continued disagreement with that holding is not enough to make the Court revisit and abandon it.

Of course, this conclusion does not end the standing analysis. That the asserted privacy harm constitutes an injury in fact is not enough; on this preliminary injunction motion, at least one plaintiff must point to evidence that shows a substantial likelihood that a particular member is suffering or will imminently suffer that harm at the hand of DOL and HHS. See Sierra Club, 754

9 Congress’s acknowledgement of the expectation of privacy in the records held by agencies completely undercuts defendants’ argument that plaintiffs’ members cannot be concretely harmed because they voluntarily shared the information with the government. See Opp’n at 29. The argument also fails as a matter of common sense: no one would argue that a person doesn’t have a privacy interest in, say, their medical records just because they shared them with their doctor’s office.

10 Defendants put forward two other unavailing arguments. One is that “discovery has shown that DOGE Affiliates “are both formally and functionally employees of the agencies at which they work” and thus plaintiffs’ members cannot be harmed by their access to their records. See Opp’n at 29. But this is a legal conclusion, and the Court must assume that plaintiffs will prevail on their legal claims when assessing standing. Comm. on Judiciary, 968 F.3d at 762. The other is that—without plaintiffs bringing it to their members’ attention—the “members would have no reason to even know that a DOGE-affiliated employee has accessed their information” and thus there was no intrusion akin to intrusion-upon-seclusion harm. See Opp’n at 30 (emphasis in original). What defendants fail to explain is why a wrongdoer’s stealth prevents his victim from suffering this sort of harm. A person may not know that someone was peeping into their window if the peeper has mastered his craft, but defendants undoubtably would agree that the person was still harmed and could bring suit upon discovering the intrusion.

13

F.3d at 999. That means plaintiffs must cite “evidence that DOL and HHS have given or will imminently give USDS personnel access to record systems containing their members’” records. AFL-CIO V, 2025 WL 1129227, at *11 n.12.

Plaintiffs have met this burden.

a. DOL

Two DOGE Affiliates—Marko Elez and Aram Moghaddassi—have been granted access to DOL’s Unemployment Insurance Data and Related Records, among other systems. Defs.’ Objections & Resps. Pls.’ Requests for Expedited Disc [ECF No. 80-5] (“Disc. Resps.”) at 17– 18.11 And “DOL believes that . . . Moghaddassi has accessed” it. Id. at 19. This system is described as “a centralized clearinghouse” of every state unemployment claim dating back to March 2020. Decl. of Michele Evermore [ECF No. 80-17] (“Evermore Decl.”) ¶¶ 4–7.12 In addition to unemployment claims, the system includes claimants’ “names, social security numbers, birth dates, claims records, and potentially other personally identifying data.” Id. ¶ 6. Both Elez and Moghaddassi retain their access today. See Disc. Resps. at 17–19.

Although only one is needed, plaintiffs put forward a host of declarations from their members who made unemployment claims some time after March 2020 and thus have records within the Unemployment Insurance Data and Related Records. Two examples include Colin Sullivan, a member of plaintiff American Federation of Labor and Congress of Industrial

11 It’s no matter that defendants granted Elez and Moghaddassi access to this system on March 21, 2025, Disc. Resps. at 18–19, after plaintiffs filed their amended complaint. See Rockwell Int’l Corp. v. United States, 549 U.S. 457, 460 (2007) (explaining that a plaintiff ordinarily must show she had standing at the time the operative complaint was filed). Plaintiffs alleged in their amended complaint that their members imminently faced harm from defendants’ access to DOL’s systems writ large. See, e.g., Am. Compl. ¶¶ 175, 185, 193. That Elez and Moghaddasi were granted access to the Unemployment Insurance Data and Related Records establishes that plaintiffs were right: the access was imminent.

12 Evermore was DOL’s “Deputy Director for Policy in the Office of Unemployment Insurance Modernization” from September 2021 until October 2022. Evermore Decl. ¶ 3.

14

Organizations (“AFL-CIO”) who applied for and received Massachusetts unemployment benefits through January 2022, see Decl. of Collin Sullivan [ECF No. 80-18] ¶ 6, and Natasha Duckett, a member of plaintiff Service Employees International Union (“SEIU”) who has applied for and received California unemployment benefits for the past two summers, see Decl. of Natasha Danielle Duckett [ECF No. 80-21] ¶ 2.13 Sullivan and Duckett are suffering or will imminently suffer harm from Elez and Moghaddassi viewing their personal information. Although the record does not explicitly confirm DOGE Affiliates have looked at either individual’s records, the facts that Moghaddassi has accessed the system and that both he and Elez retain the ability to access it make it substantially likely that they either have viewed or will soon view Sullivan and Duckett’s records. See Clapper v. Amnesty Int’l USA, 568 U.S. 398, 409 (2013) (“[T]hreatened injury must be certainly impending to constitute injury in fact.”) (emphasis in original)). The certainly impending nature of the Affiliates’ access to these members’ records is all the clearer considering the purpose for which DOL explains it granted the access: so that Elez and Moghaddassi could “review data and information for fraud, waste and abuse.” Pls.’ Excerpts of 30(b)(6) Depo. of DOL through Ricky Kryger [ECF No. 80-9] (“DOL Depo.”) at 17–18. Considering that the Unemployment Insurance Data and Related Records system was established to “facilitate identification of potentially fraudulent claims for unemployment benefits,” see Evermore Decl. ¶ 5, it requires no large logical leap to see that the system is very likely to be a main target for the Affiliates’ detailed review. And that review is happening quickly at DOL, likely because it is a “high priority of the Executive Branch,” see Opp’n at 45; see also, e.g., Disc. Resps. at 7 (explaining that one DOGE Affiliate

13 Evermore explains that only the unemployment data of “participating states” is held within this system.

Evermore Decl. ¶ 5. Defendants neither argue nor put forward evidence that Massachusetts and California are not participating states.

15

was granted access to DOL systems less than one week after the President’s inauguration). In sum, while there is some ambiguity about the scope of DOGE Affiliates’ access up to this point, the Court need not rest on a long, “speculative chain of possibilities” to conclude that the Affiliates will imminently view these members’ records. See Clapper, 568 U.S. at 414.

So Sullivan and Duckett have concrete and actual or imminent injuries in fact caused by DOL’s DOGE Access Policy and redressable by enjoining the policy. Because the other two requirements of associational standing are indisputably satisfied,14 AFL-CIO and SEIU have standing to bring their APA claim regarding DOL. See Sierra Club, 754 F.3d at 999.

b. HHS

The analysis is similar for HHS. DOGE Affiliates Luke Farritor, Zach Terrell, Elez, and Moghaddassi (yes, the same Elez and Moghaddassi) have all been granted and retain access to, among other systems, the Center for Medicare and Medicaid Services (“CMS”) Integrated Data Repository (“IDR”). Disc. Resps. at 6–14. At least Terrell and Moghaddassi have accessed it. Id. at 11–12, 14. CMS IDR “integrat[es] data on beneficiaries, providers, health plans, claims, drug data, etc.” and thus contains a mountain of data on beneficiaries and providers, including “SSN, Name, Date of birth, Email Address, Phone Numbers, Mailing Address, Medical Records Number, Medical Notes, Health Insurance Claim Number (HICN), Unique Physician Identification Number (UPIN), Race, Sex, Diagnosis Codes, [and] Procedure Codes.” HHS Table of Systems [ECF No. 80-14] at 1.15

14 AFL-CIO and SEIU’s missions of advocating for their members are germane to the privacy interests they seek to protect. See Decl. of Matthew Ginsburg, AFL-CIO [ECF No. 29-3] ¶ 3; SEIU 2024 Constitution and Bylaws [ECF No. 80-29 at 7] at 2. And the Court has already explained that no individual participation by any of plaintiffs’ members is necessary to resolve plaintiffs’ claims against DOL and HHS. AFL-CIO V, 2025 WL 1129227, *9.

15 Or, as CMS’s website describes it, IDR:

16

As for the DOL system, plaintiffs submit a host of declarations from individual members whose data is stored in CMS IDR. Two are Medicare beneficiaries Patrick Welsh, a member of plaintiff Communication Workers of America (“CWA”), see Decl. of Patrick Welsh [ECF No. 80- 22] ¶¶ 2–3, and David Gray, a member of plaintiff American Federation of Teachers (“AFT”), see Decl. of David Grey [ECF No. 82-25] ¶¶ 1, 4.

Welsh and Gray are suffering or will imminently suffer the harm caused by the DOGE Affiliates’ alleged unlawful accessing of records. As at DOL, although it is unclear which individual records DOGE Affiliates have accessed within CMS IDR, the fact that DOGE Affiliates have access to and have actually accessed that database, coupled with HHS’s statement that DOGE Affiliates are working to scan systems for “fraud, waste or abuse,” see Pls.’ Excerpts of 30(b)(6) Depo. of HHS, through Jennifer Wendel [ECF No. 80-15] (“HHS Depo.”) at 23, make it substantially likely that the HHS DOGE Affiliates have viewed or imminently will view the CMS IDR’s wealth of records—including Welsh and Gray’s records—as part of this comprehensive effort to “crush[]” fraud, waste, and abuse within CMS systems, see Crushing Fraud, Waste, & Abuse, CMS.gov, https://www.cms.gov/fraud (last accessed June 23, 2025).

Thus, Welsh and Gray would have standing in their own right: they have an actual or imminent injury in fact, caused by HHS’s DOGE Access Policy and redressable by an injunction.

is a high-volume data warehouse integrating Parts A, B, C, D, and DME claims, beneficiary and provider data sources, along with ancillary data such as contract information, risk scores, and many others. Access to this robust integrated data supports much needed analytics across CMS.

Integrated Data Repository (IDR), CMS.gov, https://www.cms.gov/about-cms/information-systems/idr (last accessed June 23, 2025); see also Dastagir v. Blinken, 557 F. Supp. 3d 160, 163 n.3 (D.D.C. 2021) (explaining that courts may take judicial notice of information on government websites).

17

Because the other two prongs of associational standing are easily satisfied as well,16 CWA and AFT have standing to bring their APA claims against HHS. See Sierra Club, 754 F.3d at 999.

II. Irreparable Harm The Court now moves to the question of whether plaintiffs have shown they are entitled to a preliminary injunction.

The four-factor standard for obtaining such “extraordinary relief” is well known: the moving party must “make a clear showing that (1) it has a likelihood of success on the merits, (2) the balance of equities favors preliminary relief, (3) an injunction is in the public interest, and (4) it will likely suffer irreparable harm before the district court can resolve the merits of the case.” Singh v. Berger, 56 F.4th 88, 95 (D.C. Cir. 2022) (internal quotation marks omitted).

What occasionally gets lost when assessing those factors, however, is both the true nature and the true goal of a preliminary injunction. The remedy is “temporary, non-determinative, [and] based on partial evidence,” see Samuel Bray, The Purpose of the Preliminary Injunction, 78 Vand. L. Rev. 809, 815 (2025), yet still imposes contempt-backed obligations on a party. Courts are thus forced to “make a choice under conditions of grave uncertainty,” O Centro Espirita Beneficiente União do Vegetal v. Ashcroft, 389 F.3d 973, 1015–17 (10th Cir. 2004) (en banc) (McConnell, J., concurring), all the while “[b]earing in mind that a grant of preliminary relief could prove to be ‘mistaken’ once the merits are finally decided,” Singh, 56 F.4th at 95. This is why granting a preliminary injunction is meant to be extraordinary—i.e., the exception, not the rule. See Munaf v. Geren, 553 U.S. 674, 690 (2008).

16

See Decl. of Daniel McNeil [ECF No. 80-26] ¶ 3 (explaining that AFT’s mission includes “promot[ing]

. . . healthcare” for their members and “advocating for [their members] privacy”); Decl. of Alex van Schaick [ECF No. 80-28] ¶¶ 5–6 (same for CWA); AFL-CIO V, 2025 WL 1129227, *9 (no individual-member participation required).

18

Accordingly, the goal of a preliminary injunction is “only to” be “a stopgap measure” that serves to “preserve the relative positions of the parties,” Singh, 56 F.4th at 95 (internal quotation marks omitted), or, said differently, “to preserve the object of the controversy in its then existing condition” until the case concludes, Aamer v. Obama, 742 F.3d 1023, 1043 (D.C. Cir. 2014) (cleaned up); see also Univ. of Tex. v. Camenisch, 451 U.S. 390, 395 (1981) (describing this as the “limited purpose” of a preliminary injunction). What these somewhat indeterminate phrases boil down to is that a preliminary injunction is meant only to ensure the court will be able to “grant effectual relief” to whoever ultimately prevails on the merits. O Centro, 389 F.3d at 1015 (McConnell, J. concurring); see 11A Charles Alan Wright & Arthur R. Miller, Federal Practice and Procedure § 2947, at 112, 114 (3d ed. 2013); Bray, supra, at 845 (“[T]he preliminary injunction is preserving the status quo as a means of safeguarding efficacy of the court’s remedial options.” (emphasis omitted)); see id. at 845–51 (explaining that this has been the purpose of preliminary injunctions since their development in the English Court of Chancery).

The nature and goal of a preliminary injunction connect particularly to the fourth preliminary injunction factor: irreparable harm. Irreparable harm “has always been” “the basis of injunctive relief in federal court.” Sampson v. Murray, 415 U.S. 61, 88 (1974) (internal quotation marks omitted). The insistence on irreparable harm follows necessarily from the purpose of a preliminary injunction. Without the possibility of such harm occurring between the motion for preliminary injunction and a disposition on the merits, a preliminary injunction would have no role to serve; “the object of the controversy” would remain static. See Aamer, 742 F.3d at 1043. It’s no wonder, then, that “[a] movant’s failure to show any irreparable harm is . . . grounds for refusing to issue a preliminary injunction, even if the other three factors entering the calculus merit such

19

relief.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006).17 The purpose can also help frame the question whether a harm is indeed irreparable: Is it a harm that, absent intervention now, the court would not be able to remedy down the line? See id. at 297–98. Or is it that the court’s ultimate remedial powers will remain intact even if the harm— however unfortunate—continues? See Del. State Sportsmen Ass’n, Inc. v. Del. Dep’t of Safety & Homeland Sec., 108 F.4th 194, 201 (3d Cir. 2024).

All of this serves as foundation for the “high standard for irreparable injury” set by the D.C. Circuit. See Chaplaincy of Full Gospel Churches, 454 F.3d at 297. For one, the asserted harm must be “certain,” “great,” and “of such imminence that there is a ‘clear and present need’ . . . to prevent” it. Id. (internal quotation marks and emphasis omitted). And “the injury must be beyond remediation.” Id. A movant’s showing only that she is suffering or may suffer an injury will not suffice, “however substantial” that injury is. Id. (quoting Va. Petroleum Jobbers Ass’n v. FPC, 259 F.2d 921, 925 (D.C. Cir. 1958)). Rather than look to severity alone, courts must “weigh[] heavily” whether the court will ultimately be able to grant “adequate compensatory or other corrective relief” to the prevailing party—i.e., whether the Court will have effective remedial options down the road. See id. So establishing standing is not enough. Otherwise, a preliminary injunction would be “the rule, not the exception.” See Munaf, 553 U.S. at 690.

Here, plaintiffs fall short of the high irreparable-harm bar—even assuming they are right that the DOGE Policies violate the Privacy Act. See Chaplaincy of Full Gospel Churches, 454 F.3d at 303 (explaining that “the irreparable harm analysis . . . assumes, without deciding, that the

17 This is true even if a sliding-scale approach to preliminary injunctions— in which “a movant’s failure to establish one of the four factors does not always doom its motion”—applies. See Clevinger v. Advoc. Holdings, Inc., 134 F.4th 1230, 1236 (D.C. Cir. 2025) (explaining that the applicability of the sliding-scale approach is an open question in this Circuit but that failure to show irreparable harm warrants denying a motion for preliminary injunction regardless of the answer to that question).

20

movant has demonstrated a likelihood that the non-movant’s conduct violates the law”). On this basis, the Court will deny their motion. See id. at 297.

Plaintiffs’ one and only alleged irreparable harm is the same harm they assert for standing:

the privacy harm that results from DOGE Affiliates viewing their records in violation of the Privacy Act. Mot. at 46–47. Plaintiffs emphasize that these records contain some of the most sensitive and private information the government can hold on a person. See id. at 47–48. That is indisputable. Even looking at only the two previously mentioned systems, the records to which DOGE Affiliates have access include employment and financial histories, and—even more concerning—a conglomerate of detailed medical information, from diagnoses all the way down to discrete medical notes. Disc. Resps. at 7–12, 17–18; Evermore Decl. ¶¶ 4–7; HHS Table of Systems at 1. And the agencies have granted DOGE Affiliates access to 25 other sensitive systems. See Disc. Resps. at 6–17 (listing 17 other HHS systems to which DOGE Affiliates have been granted access); id. at 17–20 (listing eight other DOL systems to which DOGE Affiliates have been granted access).

Yet, no matter how sensitive the information being accessed or how concerned the Court is about that access, establishing irreparable harm requires more. See Chaplaincy of Full Gospel Churches, 454 F.3d at 297. But plaintiffs put forward nothing that shows the harm their members face is “certain and great” or “beyond remediation.” See id.

As an initial matter, it’s not enough that plaintiffs have shown a Privacy Act injury in fact for standing purposes. While Congress may “elevate to the status of legally cognizable . . . injuries previously inadequate in law,” see TransUnion, 594 U.S. at 425, legally cognizable does not mean irreparable, Rondeau v. Mosinee Paper Corp., 422 U.S. 49, 64–65 (1975) (“[T]he fact that [the movant] is pursuing a cause of action which has been generally recognized to serve the public

21

interest provides no basis for concluding that it is relieved of showing irreparable harm.”); Ashland Oil, Inc. v. FTC, 409 F. Supp. 297, 307 (D.D.C. 1976). Of course, the harm here sounds in a right arguably more fundamental than some granted by statute: the right to privacy. That, however, is not enough, either: not all alleged invasions of privacy invariably result in irreparable harm. See Reporters Comm. for Freedom of Press v. Am. Tel. & Tel. Co., 593 F.2d 1030, 1067 (D.C. Cir. 1978); Samuel D. Warren & Louis D. Brandeis, The Right to Privacy, 4 Harv. L. Rev. 193, 219– 20 (1890) (explaining that “remedies for an invasion of the right to privacy” could include injunctions “in perhaps a very limited class of cases”); Baker D.C. v. Nat’l Lab. Rels. Bd., 102 F. Supp. 3d 194, 203–04 (D.D.C. 2015).

Instead, assessing whether disclosure of private information amounts to irreparable harm requires looking at (1) the type of information disclosed and (2) the breadth of disclosure and use of the information disclosed. The type of information disclosed matters because it determines the risk a movant faces from disclosure: the more sensitive the information, the more its use could further harm the movant. For example, disclosure of personally identifiable financial information could expose individuals to the risk of “identity theft and [other] misuse of personal information,” such as extortion. See Williams v. Harry’s Nurses Registry, Inc., Case No. 24-34, 2025 WL 842041, at *5 (2d Cir. Mar. 18, 2025) (internal quotation marks omitted); cf. In re U.S. Off. of Pers. Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 77 (D.C. Cir. 2019) (Williams, J., concurring in part and dissenting in part) (explaining that illegally obtained information could be used for “extortion[,] surveillance,” or “obtaining leverage over American[s]”). And perhaps more acute are the risks of disclosing medical records, which “frequently include ‘the details of a person’s family history, genetic testing, history of diseases and treatments, history of drug use, sexual orientation and practices, and testing for sexually transmitted diseases.’” United States v. Kravetz,

22

706 F.3d 47, 63 (1st Cir. 2013) (quoting U.S. Congress, Office of Technology Assessment, Protecting Privacy in Computerized Medical Information, OTA–TCT–576 (Sept. 1993)). This comprehensive view of a person’s most sensitive information risks not only “private spite or . . . public scandal,” id. (quoting Nixon v. Warner Commc’ns, 435 U.S. 589, 598 (1978)), but also the even greater risks of extortion or leverage.

Regardless of the type of information disclosed, however, the disclosure might not cause irreparable harm if it won’t travel far. Thus, if the information is disclosed only to a narrow group—in particular, if the disclosure is within the government but not beyond it—it is significantly less likely to amount to irreparable harm. See Univ. of Cal. Student Ass’n v. Carter, 766 F. Supp. 3d 114, 121–22 (D.D.C. 2025); All. for Retired Ams. v. Bessent, 770 F. Supp. 3d 79, 107–08 (D.D.C. 2025).

Crucial here is whether the disclosure is private or public. As the D.C. Circuit has held, “the individual interest in protecting the privacy of the information [obtained] by the government is significantly less important where the information is collected by the government but not disseminated publicly.” Am. Fed’n of Gov’t Emps., AFL-CIO (“AFGE”) v. Dep’t of Hous. & Urb. Dev., 118 F.3d 786, 793 (D.C. Cir. 1997). It’s no wonder why: the fewer eyes on the information and the more safeguards in place to limit further disclosure, the less risk the disclosure poses. Accordingly, courts find disclosure necessitates a preliminary injunction when there is an imminent risk that information privately disclosed or obtained illegally will either be impermissibly used or publicly disclosed. See, e.g., Ruckelshaus v. Monsanto Co., 463 U.S. 1315, 1317 (1983) (affirming grant of preliminary injunction that prevented agency from using or publicly disclosing trade secrets, but not from obtaining the trade secrets, despite movant’s allegation that the agency’s gathering of information was unconstitutional); Council on Am.-

23

Islamic Rels. v. Gaubatz, 667 F. Supp. 2d 67, 75–76 (D.D.C. 2009) (finding plaintiff would be irreparably harmed by public disclosure of proprietary information). But where there is no imminent risk of public use or disclosure before a final determination on the merits due to safeguards already in place, irreparable harm generally does not lie. See, e.g., Kaplan v. Bd. of Educ. of City Sch. Dist. of City of N.Y., 759 F.2d 256, 259–60 (2d Cir. 1985) (“[W]e are satisfied that the privacy protection procedures adopted by the Board will limit the public’s inspection of material contained in the forms.”); Doe ex rel. Doe v. Boyertown Area Sch. Dist., 897 F.3d 518, 537 (3d Cir. 2018) (“[A]ppellants did not demonstrate irreparable harm” because “[t]he School District . . . provided adequate privacy facilities for the appellants to use during this litigation.”); Ind. Prot. & Advoc. Servs. v. Ind. Fam. & Soc. Servs. Admin., 376 F. App’x 630, 632 (7th Cir. 2010); Ashland Oil, 409 F. Supp. at 308 (explaining that irreparable injury might result “from general dissemination” of private data, but not necessarily from “the transfer of such data from the FTC to” a Congressional subcommittee because that “does not lead inexorably to either public dissemination or disclosure”).

Here, the records disclosed to DOGE Affiliates no doubt contain sensitive information.

But plaintiffs demonstrate no risk that the information will be further shared or improperly used before the Court can make a final determination on the merits. As the Court already explained, DOGE Affiliates at DOL and HHS have been granted access to and have already accessed systems with sensitive information. However, the evidence before the Court also shows that DOGE Affiliates have an obligation not to share or otherwise disclose records to any unauthorized persons, let alone to the public, see DOL Depo. at 33, 37–38; Mem. of Understanding for Detail Between GSA & HHS [ECF No. 80-33] at 4; cf. DOL User Agreement [ECF No. 82-8], and indicates that DOGE Affiliates are adhering to that obligation, see Disc. Resps. at 6–20; Defs.’

24

Excerpts of of 30(b)(6) Depo. of DOL through Ricky Kryger [ECF No. 82-5] at 84; HHS Depo. at 17; Defs.’ Excerpts of 30(b)(6) Depo. of HHS, through Jennifer Wendel [ECF No. 82-4] at 21.

Given that nothing suggests the records will imminently be publicly disclosed or misused, the Court is hard-pressed to see how the harm plaintiffs’ members are suffering justifies stepping in before a final determination on the merits. First, although the members have a privacy interest under the Privacy Act, that interest is “less important” than other privacy interests because the government has collected the information without “disseminat[ing] [it] publicly.” See AFGE, 118 F.3d at 792. Second, the DOGE Affiliates’ obligations to keep the information private indicate that the agencies have “privacy protection procedures,” see Kaplan, 759 F.2d at 259–60, that help prevent the irreparable harm that may result “from general dissemination” of the records, Ashland Oil, 409 F. Supp. at 308. In short, DOGE Affiliates’ access to the records does not itself irreparably harm the members, and there is no evidence that DOGE affiliates will imminently misuse or further disclose the records. See United States v. Chem. Found., 272 U.S. 1, 14–15 (1926) (“[I]n the absence of clear evidence to the contrary, courts presume that [government officials] have properly discharged their official duties.”).

Plaintiffs don’t contest the Court’s reading of the evidence before it—which is likely why they don’t argue that their members face imminent harm beyond DOGE Affiliates’ mere access to their records. Instead, they contest the Court’s assessment of the case law, asserting that DOGE Affiliates’ “ongoing unauthorized access to sensitive employment, health, and financial data” alone causes and will cause irreparable harm. See Mot. at 47. But the cases they cite do not support that assertion.

Begin with the two cases from this District. One case doesn’t discuss irreparable harm at all, but rather discusses only whether an agency’s disclosure of certain documents falls within one

25

of the Freedom of Information Act’s exemptions. See Nat’l Sec. News Serv. v. Dep’t of the Navy, 584 F. Supp. 2d 94, 96 (D.D.C. 2008). And the case that does discuss irreparable harm determined that the movant faced such harm because its employee’s disclosure of confidential patient information would “cause irreparable harm to [the movant’s] relationship with its patients” and to “its business reputation.” Hum. Touch DC, Inc. v. Merriweather, Civ. A. No. 15-00741 (APM), 2015 WL 12564166, at *5 (D.D.C. May 26, 2015). Any harm the disclosure caused the patients wasn’t relevant. See id.

The cases from outside this jurisdiction fare no better. Again, one case does not discuss irreparable harm at all. See Plante v. Gonzalez, 575 F.2d 1119, 1135 (5th Cir. 1978). The other, Hirschfeld v. Stone, 193 F.R.D. 175 (S.D.N.Y. 2000), requires more explanation. True, it called “disclosure of confidential information” the “quintessential type of irreparable harm that cannot be compensated or undone by money damages.” Id. at 187. But two details clarify that this statement doesn’t sweep quite as broadly as it seems. First, the case is about public disclosure of confidential information, see id. at 181, 187 (explaining that the confidential information at issue had been filed unsealed with the court), and, second, the Second Circuit doesn’t appear to have the same “high bar” for irreparable harm as the D.C. Circuit does, see id. at 185; All. for Retired Ams., 770 F. Supp. 3d at 107. Zooming farther out, Hirshfeld is undergirded by two Second Circuit- specific holdings: (1) inmates have “constitutional protections against unwarranted disclosure of medical information,” id. at 186 (citing Powell v. Schriver, 175 F.3d 107, 111–13 (2d Cir. 1999)), and (2) an alleged violation of a constitutional right per se “triggers a finding of irreparable harm,” see Jolly v. Coughlin, 76 F.3d 468, 482 (2d Cir. 1996). The D.C. Circuit has held neither. In contrast, it has repeatedly declined to hold that the Constitution creates a right in the nondisclosure of personal information, see AFGE, 118 F.3d at 791–92; In re U.S. Off. of Pers. Mgmt. Data Sec.

26

Breach Litig., 928 F.3d at 72–73; see also Franklin v. District of Columbia, 163 F.3d 625, 637–38 (D.C. Cir. 1998) (explaining that prisoners do not have a constitutional right not to disclose their medical conditions to government employees), and, in any event, it has held that constitutional harm is not always irreparable harm,18 see Hanson v. District of Columbia, 120 F.4th 223, 243–46 (D.C. Cir. 2024). Hirshfeld thus doesn’t move the needle here.

In sum, plaintiffs’ argument that private disclosure of personal information alone amounts to irreparable harm holds no water in this Circuit.

Of course, determining whether a movant will suffer irreparable harm is not a matter of black-and-white, bright-line rules. See Holland v. Florida, 560 U.S. 631, 649–50 (2010) (explaining equity requires a court to “exercise judgment in light of prior precedent, but with awareness . . . that specific circumstances, often hard to predict in advance, could warrant special treatment in an appropriate case”). Given a particular set of facts, an intergovernmental disclosure may risk ridding a court of the ability to grant the movant relief at the end of the litigation. But not so here. The Court is confident that, absent a preliminary injunction, it will have effective remedial options if plaintiffs ultimately prevail on the merits.

If plaintiffs present evidence that DOGE Affiliates will publicly disclose or misuse their members’ records, then the Court will be able to prevent them from doing so, as well as from accessing additional records and retaining any records already accessed. See Am. Compl. ¶ 271– 72, 277; see Anatol Zukerman & Charles Krause Reporting, LLC v. USPS, 64 F.4th 1354, 1364 (D.C. Cir. 2023) (listing permanent injunction factors). And, of course, the Court will be able to declare the DOGE Affiliates’ access illegal. See Am. Compl. ¶ 270. Nothing suggests the Court will lose these remedial options between now and a final disposition.

18 Except First Amendment harm. See Chaplaincy of Full Gospel Churches, 454 F.3d at 303.

27

Moreover, the Privacy Act gives plaintiffs’ members an individual right of action for damages. See 5 U.S.C. § 552a(g)(1)(D). The “possibility that adequate compensatory . . . relief will be available at a later date . . . weighs heavily against a claim of irreparable harm.” Clevinger v. Advoc. Holdings, Inc., 134 F.4th 1230, 1234 (D.C. Cir. 2025) (internal quotation marks omitted). While not dispositive, the availability of a damages remedy further convinces the Court that it need not step in now for the members ultimately to gain relief if it is warranted. See Univ. of Cal. Student Ass’n, 766 F. Supp. 3d at 121–23.

In the end, the Court joins two other judges in this District and finds that plaintiffs have failed to show clearly that the DOGE Affiliates’ mere access to records is causing or will cause irreparable harm prior to a final determination on the merits. See Univ. of Cal. Student Ass’n, 766 F. Supp. 3d at 121–23; All. for Retired Ams., 770 F. Supp. 3d at 106–10.19 And without irreparable harm, a preliminary injunction cannot issue.

CONCLUSION

Absent a showing of irreparable harm, the Court must deny plaintiffs the extraordinary relief of a preliminary injunction. See Chaplaincy of Full Gospel Churches, 454 F.3d at 297. The Court notes, however, that this determination rings no death knell to plaintiffs’ ultimate claims. As explained, the Court retains remedial options if plaintiffs prevail on the merits, and plaintiffs remain free to argue that the Privacy Act’s damages remedy will not amount to “adequate . . . relief” for the privacy harms their members have suffered or will suffer. See Clevinger, 134 F.4th

19 While every judge in this District to have addressed the issue has determined DOGE Affiliates’ mere access to records does not constitute irreparable harm, two judges from the District of Maryland have concluded otherwise. See Am. Fed. of Tchrs., 2025 WL 895326, at *30–31; AFSCME, AFL-CIO v. Soc. Sec. Admin, Civ. A. No. 25-596 (ELH), 2025 WL 1206246, at *68–70 (D. Md. Apr. 17, 2025). Those determinations, however, do not change this Court’s determination. For one, the D.C. Circuit appears to have a higher bar for irreparable harm, as one District of Maryland judge explicitly acknowledged to distinguish the no-irreparable-harm findings from this District. See AFSCME, 2025 WL 1206246, at *69. For two, the case law these opinions rely on has significant overlap with that which plaintiffs rely on here. See id. at 70; Am. Fed. of Tchrs., 2025 WL 895326, at *30. As the Court has explained, that case law does not do the work plaintiffs want it to.

28

at 1234; Anatol Zukerman & Charles Krause Reporting, 64 F.4th at 1364 (noting permanent injunction requires showing that “remedies available at law . . . are inadequate to compensate for th[e] injury”). Put simply, the Court by no means green-lights DOGE Affiliates’ access to Americans’ most sensitive information. The Court simply cannot step in to enjoin such access at this juncture.

SO ORDERED.

/s/

JOHN D. BATES

United States District Judge Dated: June 27, 2025