A federal court in New York ruled on October 20 that the Office of Personnel Management violated the Privacy Act when it disclosed millions of federal employee records to agents working for the Department of Government Efficiency, the White House task force led by Elon Musk.

The court granted summary judgment against OPM, finding it violated two separate Privacy Act provisions. The first restricts disclosure of personal records between agencies without proper authorization. The second requires agencies to maintain security and confidentiality of the records they hold.

The ruling matters because it’s one of the first judicial decisions to impose real consequences on DOGE’s aggressive data collection practices. Since its creation in early 2025, DOGE has demanded access to personnel files, contractor databases, and other sensitive records as part of its mandate to identify waste and inefficiency across the federal government. Federal privacy advocates have argued these requests routinely violate statutory protections, but agencies have largely complied under pressure from the White House.

This case appears to be different. The court found OPM’s disclosure wasn’t just procedurally sloppy but unlawful on its face. The Privacy Act generally prohibits agencies from sharing records containing personal information without the individual’s consent or a specific statutory exception. OPM apparently couldn’t point to either.

What happens next depends on the remedy phase. The Privacy Act allows individuals to sue for actual damages when agencies violate its provisions, and it permits courts to order agencies to amend records or change their practices. If the plaintiffs sought an injunction, OPM may be barred from future disclosures to DOGE without proper legal authority.

The decision also sets a precedent for other pending challenges. At least three other lawsuits are working their way through federal courts challenging similar DOGE data requests at the Department of Defense, the Social Security Administration, and the IRS. Those agencies will now have to explain why their disclosures don’t violate the same Privacy Act provisions the New York court found OPM broke.

Anthropic’s Safety Bill Faces Skepticism

Meanwhile, Anthropic pitched a new AI safety bill that critics say does more to protect AI companies than the public. The proposed legislation would allow federal agencies to seek a court order blocking deployment of an AI model if it poses a risk of killing 50 or more people.

That sounds protective until you read the fine print. Under Anthropic’s proposal, agencies can’t actually block a model’s release without getting permission from a federal judge first. That means even if regulators determine a model poses catastrophic risks, the company can keep moving forward unless the government files suit and wins.

The 50-person threshold is also drawing criticism. It’s high enough that most models would never trigger it, even if they caused serious harm. A model that enables widespread fraud, destabilizes elections, or causes economic damage wouldn’t qualify unless it directly caused mass casualties.

It’s unclear whether Anthropic is seriously pushing this as legislation or simply trying to shape the debate. The company has positioned itself as a safety-focused alternative to OpenAI and has supported some forms of regulation, including California’s ultimately vetoed SB 1047. But this proposal looks more like a liability shield than a regulatory framework.

DeepSeek Ban Hits Federal Agencies

The U.S. ordered federal civilian agencies to remove DeepSeek AI products from their systems, citing national security concerns about the Chinese company. The order covers both direct use of DeepSeek’s models and third-party services built on its technology.

The directive follows a pattern of U.S. restrictions on Chinese AI tools. TikTok faces ongoing legal battles over its future in the U.S., and federal agencies have already been barred from using other Chinese-developed software on government devices.

What makes this order significant is its scope. It doesn’t just prohibit future procurement. It requires agencies to actively hunt down and remove existing DeepSeek integrations, including any tools that use DeepSeek’s technology under the hood. That could affect a significant number of federal systems, since DeepSeek’s models have been integrated into various productivity and analysis tools.

The order doesn’t cite specific intelligence findings, and the administration hasn’t publicly detailed what data DeepSeek might have accessed or how it poses a security risk. That makes it harder to evaluate whether this is a genuine threat response or part of broader U.S.-China tech competition.

For federal contractors and agencies, the message is clear: Chinese AI is off limits, even if the models are technically competitive. That calculus may extend to the private sector soon if Congress advances any of several proposed bills that would restrict Chinese AI tools more broadly.