Consider This from NPR - Over a dozen lawsuits to stop DOGE data access are betting on a 1974 law

Episode Date: March 13, 2025

The Department of Government Efficiency, or DOGE, has been trying to access the massive amounts of Americans' personal information held in databases throughout the federal government.These databases hold information far more sensitive than name, address or even social security number. Diagnoses and medical data like treatment for mental health and addiction issues is also included in the trove of data.Now, more than a dozen lawsuits are invoking a little known law from 1974 that was designed to safeguard exactly this kind of data from federal overreach.For sponsor-free episodes of Consider This, sign up for Consider This+ via Apple Podcasts or at plus.npr.org.Email us at [e-mail] more about sponsor message choices: podcastchoices.com/adchoicesNPR Privacy Policy

Date of birth, home address, social security number. I mean, these are just a few examples of some of the personal information that the U.S. government collects on most of us and stores in databases across federal agencies. Well, the Department of Government Efficiency, or DOGE, created by President Trump has been causing alarm by making massive cuts to federal staff. But it has also been seeking access to the troves of personal information that the government has on Americans,

information that can go way beyond a social security number. The level of sensitivity of the information that we're talking about is really unprecedented, and it is the most sensitive information that people provide about themselves. Elizabeth Laird directs the Equity and Civic Technology Project at the Center for Democracy and Technology. She spoke with NPR's Laurel Wamsley.

It will include demographics about you, so your race, your sex, even if you have a disability. And then I think the thing that a lot of folks don't think about, because a number of the reports of the systems that they've attempted to access or have actually accessed are financial in nature, but they also include really personal information about you. So just to take your tax records, you know, it will include any major life events that you've had. So whether you were pregnant and gave birth to a child or you adopted a child or you got married or divorced, whether you went bankrupt, things that maybe your closest friends and family

don't even know are included in these systems. And then there's the kind of information that's stored by agencies like Medicare, Medicaid, and the VA. If you are a veteran that's getting medical care from VA, your medical data is stored in VA databases. What conditions you're being treated for, what treatments you're receiving. If you have a VA therapist or you go to group therapy at VA, then, you know, therapy notes are being stored in VA databases. If you, I don't know,

have an opioid addiction because of an injury that you received while you were in service, that information is going to be potentially stored in the VA database. Jonathan Kamens has worked as a software engineer and cybersecurity professional for more than 30 years. His job was overseeing cybersecurity for the Department of Veterans Affairs main website, or va.gov. He was fired from the US Digital Service on February 14th, along with about 40 other people.

Kevin says he doesn't know what Elon Musk and his team have access to at the VA, but he is worried about the kind of sensitive data that they could access from what's stored there. There's all sorts of financial information because, you know, in order to apply for benefits, sometimes you have to disclose details about your financial circumstances. So Doge claims that what it is trying to do is to find fraud and inefficiency and waste in the federal government so that it can be eliminated. And the single biggest budget line item at the VA is the benefits that are paid out to veterans. So if you're really looking for fraud and waste and inefficiency, you're not going to be able to do that at VA without looking at the veteran benefit databases, which are the ones that have the personal information in them. Doge's efforts to access these government databases have a lot of people wondering, is there anything that can protect the personal information that we have to hand over to the federal government?

government. Consider this, a little known law exists to do just that, protect our sensitive data from government overreach and more than a dozen lawsuits now invoke this 50 year old law to stop Doge's access to this information. From NPR, I'm Elsa Chang. This message comes from WISE, the app for doing things in other currencies. Sending or spending money abroad, hidden fees may be taking a cut. With WISE, you can convert between up to 40 currencies at the mid-market exchange rate. Visit WISE.com. TNCs apply. Support for NPR and the following message come from Bowlin Branch.

Change your sleep with the softness of Bowlin Branch's 100% organic cotton sheets. Feel the difference with 15% off your first set of sheets at bowlinbranch.com with code NPR. Exclusions apply. See site for details. It's Consider This from NPR. Across federal agencies, the government stores a lot of data. And often, the data we entrust to federal agencies is very sensitive and very personal. Elon Musk's Department of Government Efficiency, or DOGE, has access to many of the databases storing that personal data and that's raising alarm.

At least a dozen lawsuits are attempting to stop DOJ from tapping into all this personal information. And these lawsuits have focused on one particular legal avenue, a 50-year-old law called the Privacy Act of 1974. With us to talk about that law is Danielle Citrin. She's a law professor at the University of Virginia. Welcome. Thank you for having me. So before we talk about these lawsuits, can you just take us back to the mid 1970s? How

did the Privacy Act of 1974 even come about? Like, what was it designed originally to do? So it was amidst a time in the late 60s where Congress sort of got wind of the fact that agencies had about 7,000 systems of records, so databases. And they've got really interested in it because the National Crime Information Center, so the FBI now we think of as the the database that shares criminal information between the state's Locals and the feds had an incredible amount of sensitive information including arrests that never went anywhere And that information was being freely shared with employers with colleges so people are losing life opportunities and you know all of this is happening in the backdrop of Watergate, in the backdrop

of Hoover's blacklist, which contained files on every single senator and congressman. There were gathering personal data on each and every one of us that were being shared across agencies without any safeguards. And there was heated agreement across the aisle that we worried that it gave government a lot of power, excessive power that could control us. And I'm sure there are a lot of people out there today who never even knew the Privacy Act of 1974 existed. How relevant has this law been over the last 50 years?

Like, how much has it been invoked when there are concerns with how the federal government is handling people's private information? The Privacy Act was once a quite sleepy lot in my privacy classes. It's gotten increasing prominence in part because there's been so much compliance with the Privacy Act. Every agency now has to put out notices about having new collections of information and databases and there's chief privacy officers at every agency. to put out, you know, notices about having new collections of information and databases. And there's chief privacy officers at every agency. You have to pay attention to it and adhere to its commitments, which are to ensure that

you don't collect information you shouldn't be collecting for a proper purpose and that you're not sharing it unless you meet the conditions of the Privacy Act. Okay. Well, then let's talk about these dozen or so lawsuits now that concern access doge has had to personal data. Who exactly is filing these lawsuits? What's the argument that the plaintiffs are making here? Privacy groups and attorneys are representing employees of the government and individuals

whose data is collected in these systems of records that are protected by the Privacy Act. And they're arguing that there's real harm here. They're losing their jobs. They're being fired. Presumably, we need to figure out in discovery if the loss of those jobs have to do with being in the databases, but we're pretty sure that's probably true. Need to figure out who the employees are so you can fire them. And asserting that the Privacy Act is sacred and that we honor when you turned over your data and you directly gave it to an agency, that it would only be accessed and used and disclosed pursuant to that reason you gave it to them and you trusted the government

with that information. Okay, but what is the argument that the Trump administration is making for why they are allowed, members of DOJ are allowed to access this information? The Trump administration is arguing that the DOJ employees, let's say they're working at the Department of Education, that they have every right to go into these systems of records to check for fraud, waste, and abuse. Simply because they are now employees of the Department of Education? That's right.

And it's a fundamental misunderstanding of the Privacy Act that if they worked at the Department of Education, they couldn't get into records that include personal data unless it was part of their job. And part of the Privacy Act is really specific about conditions on when, for law enforcement purposes, you can disclose information that's protected by the Privacy Act. And it's only when the head of a law enforcement agency makes a written request, it's really particularized about what records it wants. Even if a judge does rule that federal agencies should not be sharing this sensitive data with DOJ,

isn't there still the possibility that the Trump administration won't be deterred and will continue to give DOJ access anyway? I'm sorry even to be asking this question right now, but who's to say the Trump administration will care what a judge rules? Right. I mean, that's a fundamental question on the minds of every law professor, lawyer and law student, that even if, you know, court so orders that don't employees shouldn't have access to these records and that they should destroy any data that they collected in violation of the Privacy Act, that they may just say, sorry, I'm not going to comply with court order." And I think at that moment when that happens, you know, it's really testing our confidence in democracy and the rule of law. Danielle Citron is a law professor at the University of Virginia.

Thank you very much for speaking with us. Thank you so much. This episode was produced by Catherine Fink and NPR correspondent Laurel Wamsley contributed to the episode. It was edited by Jeanette Woods and Nadia Lancy. Our executive producer is Sammy Yenigan. It's Consider This from NPR. I'm Elsa Chang.

Hey, I'm Scott Schaeffer. And I'm Marisa Lagos. We host Political Breakdown. With the 2024 election over and President Trump in the White House, there's going to Hey, I'm Scott Schaefer. And I'm Marisa Lagos. We host Political Breakdown. With the 2024 election over and President Trump in the White House, there's going to be a lot to keep up with this year. Political Breakdown has got you covered. We'll bring smart analysis, a wide range of voices, and even some laughs.

Join us for Political Breakdown every Tuesday, Thursday, and Friday from KQED, part of the NPR Network. Hi, it's Terry Gross, host of the NPR network. He was hilarious and introspective in the interview and it was a wild ride. You can hear a special extended version of this interview on the Fresh Air podcast from NPR and WHYY. Want to hear this podcast without sponsor breaks? Amazon Prime members can listen to Consider This sponsor free through Amazon Music. Or you can also support NPR's vital journalism and get Consider This Plus at plus.npr.org.

That's plus.npr.org.