
Judge orders Musk and DOGE to delete personal data taken from Social Security
arstechnica.com
Bad DOGE Judge orders Musk and DOGE to delete personal data taken from Social Security Restraining order blocks DOGE's "unlimited access" to Social Security records. Jon Brodkin Mar 21, 2025 2:18 pm | 12 A sign in front of the entrance of the Security Administration's main campus on March 19, 2025 in Woodlawn, Maryland. Credit: Getty Images | Kayla Bartkowski A sign in front of the entrance of the Security Administration's main campus on March 19, 2025 in Woodlawn, Maryland. Credit: Getty Images | Kayla Bartkowski Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreA federal judge yesterday issued a temporary restraining order blocking DOGE's access to Social Security Administration records, saying the DOGE agency created by President Donald Trump "is essentially engaged in a fishing expedition at SSA, in search of a fraud epidemic, based on little more than suspicion."Plaintiffs are likely to win their case alleging that DOGE (Department of Government Efficiency) and other government defendants are violating the Privacy Act and the Administrative Procedure Act, said a ruling by US District Judge Ellen Lipton Hollander in the District of Maryland. Social Security officials "provided members of the SSA DOGE Team with unbridled access to the personal and private data of millions of Americans, including but not limited to Social Security numbers, medical records, mental health records, hospitalization records, drivers' license numbers, bank and credit card information, tax information, income history, work history, birth and marriage certificates, and home and work addresses," Hollander wrote.Trump and Musk have claimed there is widespread Social Security fraud, with Musk calling it "the biggest Ponzi scheme of all time." But there's no evidence to justify the DOGE access purportedly needed to root out fraud, Hollander wrote:Yet, defendants, with so-called experts on the DOGE Team, never identified or articulated even a single reason for which the DOGE Team needs unlimited access to SSA's entire record systems, thereby exposing personal, confidential, sensitive, and private information that millions of Americans entrusted to their government. Indeed, the government has not even attempted to explain why a more tailored, measured, titrated approach is not suitable to the task. Instead, the government simply repeats its incantation of a need to modernize the system and uncover fraud. Its method of doing so is tantamount to hitting a fly with a sledgehammer.SSA, Musk, and DOGE are defendantsThe defendants are the SSA and its leaders; Elon Musk, "in his official capacity as Senior Advisor to the President and de facto head of DOGE"; the US DOGE Service; the US DOGE Service Temporary Organization; and DOGE Acting Administrator Amy Gleason. There are also "ten anonymous individuals affiliated with the Department of Government Efficiency with unfettered access to the SSA records of millions of Americans," Hollander wrote.The lawsuit was filed by the American Federation of State, County and Municipal Employees; the Alliance for Retired Americans; and American Federation of Teachers. "Never before has a group of unelected, unappointed, and unvetted individualscontradictorily described as White House employees, employees of either existing or putative agencies (multiple and many), and undefined 'advisors'sought or gained access to such sensitive information from across the federal government," the lawsuit said.A temporary restraining order preserves the status quo until a preliminary injunction hearing can be held, although the legal standards for granting a temporary restraining order or preliminary injunction are essentially the same, Hollander wrote. A temporary restraining order lasts 14 days by default but can be extended."In my view, plaintiffs have shown a likelihood of success on the merits as to their claim that the access to records provided by SSA to the DOGE Team does not fall within the need-to-know exception to the Privacy Act. Therefore, the access violates both the Privacy Act and the APA," Hollander wrote.The SSA has meanwhile been hit with DOGE-fueled budget cuts affecting its operations.The orderThe order says the SSA must cut off DOGE's access. Musk, Gleason, and all other DOGE team members and affiliates "shall disgorge and delete all non-anonymized PII [personally identifiable information] data in their possession or under their control, provided from or obtained, directly or indirectly, from any SSA system of record to which they have or have had access, directly or indirectly, since January 20, 2025," it says.The DOGE defendants are also prohibited "from installing any software on SSA devices, information systems, or systems of record, and shall remove any software that they previously installed since January 20, 2025, or which has been installed on their behalf," and are prohibited "from accessing, altering, or disclosing any SSA computer or software code."The SSA is allowed to provide DOGE with redacted or anonymized records, and may provide "access to discrete, particularized, and non-anonymized data, in accordance with the Privacy Act" under certain conditions. "SSA must first obtain from the DOGE Team member, in writing, and subject to possible review by the Court, a detailed explanation as to the need for the record and why, for said particular and discrete record, an anonymized or redacted record is not suitable for the specified use," the order said. "The general and conclusory explanation that the information is needed to search for fraud or waste is not sufficient to establish need."Defendants were ordered to file a status report by March 24 to certify their compliance and document the actions taken to comply with the order.DOGE is an agency, despite denying itThis is just one of numerous lawsuits filed over DOGE's extraordinary access to personal data housed in government systems. A federal judge in one case blocked DOGE from accessing private data held by the US Department of Education and Office of Personnel Management (OPM) and found that "plaintiffs have shown that Education and OPM likely violated the Privacy Act by disclosing their personal information to DOGE affiliates without their consent." In another case, Musk and Trump are appealing a court order requiring the government to turn over information about DOGE.During a hearing, "defendants took the position that DOGE is not an agency," but Hollander rejected this claim. Even if it was true, DOGE not being an agency would hurt its defense, the judge wrote."This is curious. If DOGE is not an agency, then its employees cannot be detailed from DOGE to the SSA under the Economy Act," she wrote.Other courts already ruled that DOGE is an agency, Hollander noted. "Guided by case law, and without the benefit of briefing on the issue, I am satisfied, for the purposes of this opinion, that DOGE is an agency with[in] the meaning of the Privacy Act," the ruling said. "Were I to rule otherwise, I would be compelled to conclude that disclosure of SSA records to the DOGE Team constituted a violation of the Privacy Act, because members of the DOGE Team could not qualify as employees of an agency detailed to SSA."Jon BrodkinSenior IT ReporterJon BrodkinSenior IT Reporter Jon is a Senior IT Reporter for Ars Technica. He covers the telecom industry, Federal Communications Commission rulemakings, broadband consumer affairs, court cases, and government regulation of the tech industry. 12 Comments
0 Comentários
·0 Compartilhamentos
·19 Visualizações