The Trump administration breached a federal privacy law by letting workers from Elon Musk’s Department of Government Efficiency (DOGE) access information on millions of government workers, privacy advocates including the Electronic Frontier Foundation (EFF) allege in a new lawsuit filed on behalf of two labor unions and a group of current and former federal employees.

The groups allege that DOGE and the Office of Personnel Management (OPM) violated the Privacy Act of 1974, which protects information maintained by federal agencies. OPM maintains information on “tens of millions of current and former federal employees, contractors, and job applicants,” including disabilities, background check information, and health records, the lawsuit says. The agency also has information on workers in “highly sensitive roles for whom even acknowledging their government employment may be problematic,” such as Central Intelligence Agency (CIA) workers, it adds. The labor groups allege Trump allowed Musk and his DOGE staffers to access OPM computer networks that stored this information before they were even considered government employees, putting workers’ sensitive information in jeopardy.

DOGE lacks “a lawful and legitimate need for such access” to OPM files, the groups allege. They’re asking the US District Court in the Southern District of New York to suspend DOGE staffers’ access to the system, and prevent them from using any information they allegedly illegally accessed already. They also want the court to order any copies of data unlawfully accessed to be destroyed.

OPM is already facing a separate lawsuit from labor groups over the Trump administration’s “fork in the road” offer of deferred resignation, which promised payment that Congress had not yet appropriated. A federal judge has s0 far delayed the deadline for federal workers to opt to take the offer, pending further consideration by the court.

While the Trump administration has insisted that DOGE staffers have legally accessed information and have the necessary clearances to do so, they have not provided much detail on what those clearances are. Government workers have expressed skepticism that the inexperienced cadre of staffers at DOGE could have made it through the typically arduous clearance process to access sensitive information in the few weeks that Trump has been in office. The lawsuit insists that any exceptions to the Privacy Act, like for law enforcement purposes, are not applicable in this case.

Increased access to OPM information could create new vulnerabilities for that data, experts fear. After all, OPM databases were breached in 2014, resulting in sensitive information on more than 20 million people being compromised.

The labor unions and employees “reasonably fear harmful consequences of the disclosure and use” of information accessed by DOGE, the lawsuit claims. “Defendant Donald Trump, DOGE director Elon Musk, and others have repeatedly threatened to fire government employees they view as disloyal. They have repeatedly and unlawfully purported to fire government employees and shutter entire departments. And they have affirmatively put in place policies that seek to terminate government employees based on their gender identity.”