A good reason is not a permission

The holding

On October 20, 2026, Judge Denise Cote (U.S. District Court, Southern District of New York) ruled by summary judgment in AFGE v. OPM that the Office of Personnel Management violated the Privacy Act twice by granting DOGE agents broad access to systems of records holding the data of tens of millions of federal employees, retirees, and applicants.[1][3]

The two violations are not the same thing:[3]

  1. 5 U.S.C. § 552a(b) — bars disclosure of a record to any person or agency without the individual’s written request or prior written consent, absent an express statutory exception.[4][5] The exception list is closed.
  2. 5 U.S.C. § 552a(e)(10) — requires the agency to establish appropriate administrative, technical, and physical safeguards to insure the security and confidentiality of those records.[4][5]

There is a third consequence. Because those two provisions were violated, the conduct was “not in accordance with law” under 5 U.S.C. § 706(2)(A), so the plaintiffs’ Administrative Procedure Act claim resolved in their favor as well.[3]

The part that matters for your contract

The court did not accept the modernization justification. It wrote:[3]

“The record also provides no support for a finding that it was the pursuit of a modernization agenda that prompted OPM to grant sweeping and expedited access to a score of DOGE Agents to its systems of records containing PII.”

In plain terms: the record does not support the claim that a modernization agenda prompted the sweeping, expedited access.[3] A “we had a good reason” argument does not survive a federal court reading the underlying record.

One structural detail is worth borrowing verbatim: summary judgment is not provisional. It resolves the legal question on the existing record instead of sending the case to trial, so the finding about what OPM did is no longer subject to trial-level proof.[2] The remedy is still open — what OPM must actually do about those records gets decided later — but the fact is settled.[2]

So the factual order reads: tens of millions of federal employees’ personal records,[1] handed to a group of agents from another Department,[3] under sweeping and expedited access, with no documented purpose that survived a judge’s scrutiny.[3]

Three clauses for your RFP

OPM/DOGE maps directly onto something you already have or will have: a vendor, an integrator, or a corporate customer with legitimate access to your cameras, your NVR, or your footage, who also passes data — or reserves the right to pass data — to a third party that is not your vendor. Three clauses close that gap.

1. Third-party data-flow disclosure clause. The vendor names in writing every outside office, customer, sub-integrator, or service that receives data derived from your cameras, with its jurisdiction and the cadence on which that list is refreshed. Not “we can look into it” — a named list.

2. Consent-and-legal-process clause for third-party access. No third party touches your footage or metadata without your documented consent plus a verifiable legal-process trigger, logged immutably with a timestamp. No log, no access.

3. Judgment-based termination clause. If any court declares the underlying data flow unlawful, you can terminate without penalty and export your data on a short, fixed deadline.

What this is not

This does not mean sharing data across offices is always unlawful. The Privacy Act has express exceptions —including routine use, defined as the use of a record “for a purpose which is compatible with the purpose for which it was collected,“[4] and disclosure to another agency for law enforcement purposes on the written request of the agency head. What this case eliminates is the gray zone where a third party with legitimate access and no documented purpose presents necessity as if it were sufficient. When access is sweeping and expedited and the purpose is undocumented, “we had a good reason” is not a defense.[3]

P.D. Open your analytics or camera contract and find the name of every third party that receives data or metadata. Are they all named in writing, with a refresh cadence? If you cannot point to a list — or the list says “and other partners as needed” — you have precisely the problem Judge Cote made irrelevant this week.

Sources

[1] https://www.eff.org/deeplinks/2026/10/victory-court-rules-opms-disclosure-personal-records-doge-unlawful — Electronic Frontier Foundation, Mario Trujillo: “Victory! Court Rules OPM’s Disclosure of Personal Records to DOGE is Unlawful” (October 20, 2026) [2] https://stateofsurveillance.org/news/daily-surveillance-briefing-october-21-2026/ — State of Surveillance: “Daily Surveillance Briefing, October 21, 2026: OPM Ruled Unlawful” (October 21, 2026) [3] https://www.eff.org/files/2026/10/20/241_opinion_and_order_2026-10-20.pdf — U.S. District Court, Southern District of New York, AFGE v. OPM, Case 1:25-cv-01237-DLC, Document 241, Opinion and Order (Judge Denise Cote, October 20, 2026), 39 pp. [4] https://www.govinfo.gov/content/pkg/USCODE-2018-title5/html/USCODE-2018-title5-partI-chap5-subchapII-sec552a.htm — U.S. Government Publishing Office: USCODE-2018-title5 §552a, Privacy Act of 1974, subsections (b) and (e)(10) [5] https://www.law.cornell.edu/uscode/text/5/552a — Cornell Legal Information Institute: 5 U.S.C. §552a (corroborating text of subsections (a)(7), (b), and (e)(10))