Case: National Treasury Employees Union v. Vought

This case challenges a federal agency's alleged unauthorized disclosure of employee data under the guise of governmental efficiency. On February 9, 2025, the National Treasury Employees Union (NTEU) filed this lawsuit in the U.S. District Court for the District of Columbia against Russell Vought, in his official capacity as Acting Director of the Consumer Financial Protection Bureau (CFPB). The union represents current and former CFPB employees and argues that the Bureau's decision to share personnel records with members of the Department of Government Efficiency (DOGE) violates federal privacy laws. On behalf of its members, current and former employees of the Consumer Financial Protection Board (CFPB), NTEU brought this action on Feb. 9, 2025, in the U.S. District Court for the District of Columbia, seeking an injunction against disclosure of employees' information to staff of the “Department of Government Efficiency.”  

NTEU, a labor union representing thousands of federal employees across multiple agencies, brought the lawsuit on behalf of its members who worked at CFPB. The complaint alleged that the Bureau had unlawfully granted DOGE personnel access to internal systems containing sensitive employee data, including personal and employment-related records. The union claimed this action violated the Privacy Act of 1974 (5 U.S.C. § 552a), which prohibits federal agencies from sharing personnel records without employee consent, except in narrowly defined circumstances. NTEU also pointed to CFPB’s internal regulations (12 C.F.R. § 1070), which reinforced these privacy protections. The lawsuit stemmed from Executive Order 14158, signed by President Donald J. Trump on January 20, 2025. This order established DOGE and directed federal agencies to provide its personnel with broad access to government records, IT systems, and databases. The executive order also stated that it displaced prior executive orders and regulations that might restrict DOGE’s access to federal agency records. NTEU argued that CFPB’s compliance with this directive was unlawful because it disregarded federal privacy protections and exposed employees to potential harm. The situation escalated when Russell Vought was appointed Acting Director of CFPB on February 7, 2025. That same day, he instructed CFPB staff to grant DOGE operatives access to non-classified agency systems. Shortly afterward, Elon Musk, who had been given a leadership role in DOGE, posted “RIP CFPB” on social media, further raising concerns about the administration’s intentions toward the agency. Reports indicated that DOGE personnel had already embedded themselves in several government agencies, including the Office of Personnel Management (OPM), where they had gained access to employee personnel records containing Social Security numbers, pay grades, and home addresses. NTEU’s lawsuit described the immediate and irreparable harm this unauthorized data-sharing posed to CFPB employees. Union members feared that their private information could be misused, leaked, or exploited for retaliation against employees who opposed the administration’s policies. Employees working on financial enforcement cases were particularly concerned that DOGE personnel might access sensitive case materials and use the information to interfere with ongoing regulatory efforts. Additionally, employees with medical accommodations worried that their confidential health records could be accessed and used against them.

The lawsuit sought several remedies. NTEU requested a declaratory judgment that CFPB’s disclosure of employee records to DOGE was unlawful. It also sought a permanent injunction preventing any further access to employee information. The complaint asked the court to affirm that Executive Order 14158 could not override the Privacy Act and that CFPB was required to follow established legal procedures before sharing personnel data. Finally, NTEU requested attorneys’ fees and costs for bringing the lawsuit.

The case is ongoing.