Alex Milan Tracy/Sipa USA via AP Images
The government issues roughly 1.4 billion payments per year.
One of the most important lawsuits in the history of the United States has been filed by one advocacy group and two unions, seeking to halt Elon Musk and his Department of Government Efficiency (DOGE) team’s access to the Treasury Department’s payment system. The lawsuit primarily alleges that the disclosure of hundreds of millions of personal financial records that are part of the system is unlawful and must be stopped.
As discussed earlier, Treasury’s Bureau of the Fiscal Service (BFS) handles more than one billion financial transactions annually for the U.S. government, both outgoing grants and payments and incoming tax receipts. While serving as the largest cash management operation in the world, BFS collects personal and financial information about the people and businesses on the other side of the transactions, including “names, Social Security numbers, birth dates, birth places, home addresses and telephone numbers, email addresses, and bank account information.” This is all kept inside government databases governed by federal privacy laws, both the Privacy Act of 1974 and, in the case of taxpayer information, statutory IRS rules governing disclosure.
The Alliance for Retired Americans, the American Federation of Government Employees, and the Service Employees International Union filed the suit in D.C. District Court. Every member of these organizations likely has personal information in the hands of the BFS.
The lawsuit alleges that Scott Bessent, the new Treasury secretary, violated the law by pushing out David Lebryk, the senior civil servant in charge of the payment system, and giving DOGE access to data and computer networks. Any change of this type requires Treasury to give a “system of records notice” (SORN) in the Federal Register for 30 days, while allowing public comment.
Under the Privacy Act, no disclosure of any record can be given unless “the individual to whom a record pertains” (in this case, practically every American) consents, or an exception applies. The exceptions would be if officers and employees of the agency “have a need for the record in the performance of their duties,” or if there’s a “routine use” stipulated in the SORN. For IRS records, only statutory authorization allows disclosure of returns to those who are not involved in tax administration.
By not making any public announcement or going through any process justifying the change, Bessent violated the Administrative Procedure Act, the complaint alleges. There has clearly been no consent to record disclosure on the part of the public. And it’s completely unclear who now has access to the BFS data records, and whether they are employees of the BFS, the Treasury Department, or even the federal government.
Tom Krause, the current CEO of Cloud Software Group, is allegedly a Treasury Department official and a “liaison” to DOGE who is leading the team with access to the payment system. Few other details on the plan have been released. Even if everyone with access is a Treasury employee, which is unknown, they may not be directly involved with tax administration, or may not need the records in the performance of their duties or for routine use. If so, that would violate the Privacy Act and IRS statutes.
Musk has been boasting that his team is “rapidly shutting down … illegal payments,” which the plaintiffs cite in the lawsuit. Even if they have no ability to manipulate payments yet, having access to individual personal information could violate privacy statutes.
“Retirees, taxpayers, federal employees, companies, and other individuals from all walks of life have no assurance that their information will receive the protection that federal law affords,” the complaint reads. Because no fine would likely serve as a remedy, the plaintiffs ask for an injunction to separate DOGE from the payment system.
It’s interesting that the plaintiffs decided to go with privacy violations as the primary rationale for the lawsuit. There are any number of ways that Musk and DOGE could violate the law by commandeering the payment system, but until they actually stop a payment, many of them are theoretical. By contrast, the privacy breach is immediate and continuous.
That could help them show immediate injury from the action. “I think it is a strong argument. My only concern is whether they can show they are injured and have standing to sue for this,” said Erwin Chemerinsky, dean of the UC Berkeley Law School. Whether the courts agree that the privacy laws have been breached will settle the standing argument.
“It is disgraceful that the Trump administration has allowed unelected billionaires and their lackeys unfettered access to the personal and financial information of Americans,” said Everett Kelley, national president of the American Federation of Government Employees, in a statement. “Together, we can stop this violation of American citizens’ privacy.”
There’s also an extreme irony with the lawsuit. One of the claims is that DOGE violated strict rules around release of taxpayer information. The last person to be convicted of that crime was Charles Littlejohn, who released the tax returns of Elon Musk and Donald Trump, among others, to make the point that mega-billionaires paid little or nothing in taxes.
