UNIVERSITY OF CALIFORNIA STUDENT ASSOCIATION v. CARTER (2025)

MEMORANDUM OPINION AND ORDER

Plaintiff, an organization representing students in the University of California school system, moves for an emergency order temporarily restraining Acting Secretary of Education Denise Carter and the Department of Education (collectively, “ED”) “from disclosing information” about Plaintiff's members “to individuals affiliated with the so-called Department of Government Efficiency (DOGE).” Dkt. 9-4 at 1. Plaintiff further seeks an order requiring ED “to retrieve and safeguard any such information that has already been obtained by and shared or transferred by DOGE or individuals associated with it.” Id. For the reasons that follow, the Court will deny Plaintiff's motion.

I. BACKGROUND

A. Statutory and Regulatory Background

Each year, “Congress provides billions of dollars through loan and grant programs to help students pay tuition for their postsecondary education.” Ass'n of Priv. Sector Colls. & Univs. v. Duncan, 681 F.3d 427, 433 (D.C. Cir. 2012). The Department of Education “administers these programs, which were established under Title IV of the Higher Education Act of 1965.” Id. In that role, “ED collects and maintains [students’] sensitive personal and financial information, including their name, Social Security number (SSN), date of birth, student loan account information, contact information, driver's license number, and financial information.” Dkt. 1 at 2 (Compl. ¶ 2) (internal quotation marks, citation, and alteration omitted). These data are maintained in various ED systems and databases, at least one of which also stores students’ “Federal Tax Information,” “such as income, filing status, exemptions, and tax credits.” Id. at 2, 11 (Compl. ¶¶ 5, 36).

As a federal agency, ED is subject to the Privacy Act of 1974, 5 U.S.C. § 552a, as well as “the confidentiality requirements of the Internal Revenue Code,” see 26 U.S.C. § 6103; Dkt. 1 at 12 (Compl ¶ 45). The Privacy Act “regulates the collection, maintenance, use, and dissemination of information about individuals by federal agencies.” Wilson v. Libby, 535 F.3d 697, 707 (D.C. Cir. 2008) (internal quotation marks and citations omitted). Under the Privacy Act, agencies may not “disclose any record” to “any person, or to another agency” unless the individual consents or a statutory exception applies. 5 U.S.C. § 552a(b). As relevant here, one statutory exception permits disclosure to “officers and employees of the agency which maintains the record who have a need for the record in the performance of their duties.” Id. § 552a(b)(1). Another exception permits disclosure for “routine use,” which refers to a use of the record “for a purpose which is compatible with the purpose for which [that record] was collected.” Id. § 552a(b)(3), (a)(7). To invoke this exception, an agency must publish a notice of the asserted “routine use” in the Federal Register, along with “the categories of users and the purpose of such use.” Id. § 552a(e)(4)(D).

ED has published the “routine uses” applicable to its various databases, which permit certain disclosures. See, e.g., 89 Fed. Reg. 44652 (May 21, 2024) (National Student Loan Data System); 88 Fed. Reg. 41942 (June 28, 2023) (Common Origination and Disbursement System); 88 Fed. Reg. 42220 (June 29, 2023) (FUTURE Act System); 73 Fed. Reg. 177 (January 2, 2008) (Financial Management System). For example, ED may disclose records in the National Student Loan Database to other federal agencies for “routine uses” including “[t]o support auditors and program reviewers” of the federal student aid programs, “[t]o assist program administrators with tracking refunds and discharges” of loans, as well as “[t]o support the investigation of possible fraud or abuse and to detect and prevent fraud or abuse” in ED's loan programs, among others uses. 89 Fed. Reg. 44652, 44657–58 (May 21, 2024).

The Privacy Act authorizes both criminal penalties and private enforcement for violations of its provisions. In particular, “[a]ny officer or employee of an agency, who by virtue of his employment or official position, has possession of, or access to, agency records which contain individually identifiable information the disclosure of which is prohibited by [the Privacy Act] and who knowing that disclosure of the specific material is so prohibited, willfully discloses the material in any manner to any person or agency not entitled to receive it, shall be guilty of a misdemeanor.” 5 U.S.C. § 552a(i)(1). In addition, although individual government employees are not subject to civil suit for damages, an individual “may bring a civil action against the agency” for failure “to comply with any ․ provision of” the Act, but only if the individual suffers “an adverse effect” due to that violation. Id. § 552a(g)(1).

Like the Privacy Act, the Internal Revenue Code also controls disclosure of individuals’ personal information, both within and outside the government. Section 6103 of the Internal Revenue Code provides that, as a “general rule,” “returns and return information shall be confidential.” 26 U.S.C. § 6103(a) (capitalization altered). Section 6103(l)(13), however, permits the IRS to disclose some tax return information to ED. Upon request of the Secretary of Education, the IRS may disclose an individual's return information to “any authorized person,”¹ but only to the extent necessary to serve specified purposes, including “determining eligibility for, or repayment obligations under, income-contingent or income-based repayment plans,” id. § 6103(l)(13)(A), “monitoring and reinstating loans,” id. § 6103(l)(13)(B), and “determining eligibility for, and amount of, Federal student financial aid under a [financial aid] program,” id. § 6103(l)(13)(C). “In addition to [these] purposes, return information so disclosed may be used by an authorized person ․ for purposes of ․ reducing the net cost of improper payments under [income-contingent or income-based repayment] plans,” “oversight activities by the Office of the Inspector General of the Department of Education as authorized by the Inspector General Act of 1978, and ․ conducting analyses and forecasts for estimating costs related to [ ] plans, awards, or discharges.” Id. § 6103(l)(13)(D).

To enforce these limits, the Internal Revenue Code also provides for criminal penalties and private enforcement. The private enforcement provision provides that if “any officer or employee of the United States knowingly, or by reason of negligence, inspects or discloses any return or return information ․ in violation of any provision of [S]ection 6103,” the affected individual may bring an action against the United States for damages of $1,000 or more. Id. § 7431(a)(1). In addition, it constitutes a felony for “any officer or employee of the United States ․ willfully to disclose to any person, except as authorized by [the Internal Revenue Code], any return or return information.” Id. § 7213; see also 18 U.S.C. § 1905.

B. Factual and Procedural Background

On the day of his inauguration, President Trump issued an Executive Order creating the “Department of Government Efficiency,” commonly known as “DOGE.” Exec. Order No. 14,158, 90 Fed. Reg. 8441 (Jan. 20, 2025). The Executive Order did three things. First, it renamed the United States Digital Service ² as the United States DOGE Service (“USDS”) and established it in the Executive Office of the President. 90 Fed. Reg. at 8441. Second, it established a “temporary organization” under 5 U.S.C. § 3161 entitled “the U.S. DOGE Service Temporary Organization.” Id. The Executive Order provides that “[t]here shall be a USDS Administrator established in the Executive Office of the President,” charged with heading the DOGE Service Temporary Organization during its 18-month existence. Id. Pursuant to the temporary organization statute, 5 U.S.C. § 3161, the head of the DOGE Service Temporary Organization may “appoint persons to positions of employment in [the] temporary organization in such numbers and with such skills as are necessary for the performance of the functions required of [the] organization.” 5 U.S.C. § 3161(b)(1). Third, it created so-called “DOGE Teams.” 90 Fed. Reg. at 8441. The Executive Order required each executive agency head to establish in their agency a “DOGE Team,” which “will typically include one DOGE Team Lead, one engineer, one human resources specialist, and one attorney.” Id.

According to the Executive Order, DOGE's purpose is to “improve the quality and efficiency of government-wide software, network infrastructure, and information technology (IT) systems.” 90 Fed. Reg. at 8441. To that end, the Executive Order directs “Agency Heads” to “take all necessary steps, in coordination with the USDS Administrator and to the maximum extent consistent with law, to ensure USDS has full and prompt access to all unclassified agency records, software systems, and IT systems.” Id. at 8442. “Since his inauguration,” however, “President Trump has not formally identified the individual who would serve as USDS Administrator.” Dkt. 1 at 14 (Compl. ¶ 49).

Following issuance of the Executive Order, DOGE began hiring new employees and working with agencies, including ED. There are currently at least “[s]ix individuals at the Department of Education, all federal employees, [ ] assisting with implementing” the Executive Order “as part of [ED's] DOGE Team.” Dkt. 16-1 at 2–3 (citing Ramada Decl. ¶¶ 3–7); Dkt. 17 at 1, 24. According to Adam Ramada, a DOGE employee, ED “is the ‘home’ agency of two of these employees,” and the others, including Ramada, “are on detail to the Department.” Dkt. 18-2 at 2 (Supp. Ramada Decl. ¶ 3). Ramada attests that he and one other detailed employee are on detail from DOGE, while the remaining two employees “are on detail from other federal agencies.” Id. Ramada further reports that he spends “50–60 hours per week working at Department facilities, as do the two employees whose home agency is the Department.” Id. (Supp. Ramada Decl. ¶ 4). “Of the other detailed employees, two spend [about] 20–30 hours per week at the Department, and the last spends [about] 5 hours per week at the Department.” Id. According to Ramada, “[a]ll six employees ․ assist the Department of Education with auditing contract, grant, and related programs for waste, fraud, and abuse” and “help senior Department leadership obtain access to accurate data and data analytics to inform their policy decisions at the Department.” Id. (Supp. Ramada Decl. ¶ 5). Ramada further avers that he is unaware “of any DOGE-affiliated individual other than [these] six ․ who have been granted access to Department information technology and data systems or who have otherwise received any Department information protected by the Privacy Act or [S]ection 6013 of the Internal Revenue Code.” Id. at 3 (Supp. Ramada Decl. ¶ 7). To date, according to Ramada, the six DOGE-affiliated employees “have primarily worked to identify contracts and grants that are wasteful, abusive, or inconsistent with leadership's policy priorities.” Id. (Supp. Ramada Decl. ¶ 8). All but one of the employees has “completed ethics [and] information security trainings,” and the sixth employee has “been directed to complete” those trainings “this week.” Id. (Supp. Ramada Decl. ¶ 9).

News reports of DOGE staffers’ access to student data prompted Plaintiff University of California Student Association (“UCSA”) to file the instant complaint, Dkt. 1, as well as an emergency motion for a temporary restraining order three days later, Dkt. 9. UCSA is a nonprofit organization whose membership consists of over 230,000 students across the University of California's nine undergraduate campuses. Dkt. 1 at 6–7 (Compl. ¶ 15). More than 70% of USCA's members receive federal financial aid through programs administered by ED, which means that those members have shared a significant amount of their personal information with ED. Dkt. 1 at 7 (Compl. ¶ 15). UCSA contends that, by granting the DOGE Team “access” to these data, ED “ha[s] harmed UCSA's members by depriving them of the privacy protections guaranteed to them by federal law.” Id. at 14–16 (Compl. ¶¶ 53, 57).

UCSA seeks an emergency order enjoining ED from sharing UCSA members’ data with DOGE staffers, as well as an order requiring ED to retrieve any data already shared. Dkt. 9-4 at 1. UCSA asserts three counts under the Administrative Procedure Act, 5 U.S.C. § 551 et seq., predicated on alleged violations of the Privacy Act, ED regulations, and the Internal Revenue Code. UCSA asserts that ED is acting contrary to law, in violation of 5 U.S.C. § 706(2)(A) (Count I), that ED's action is arbitrary and capricious, in violation of 5 U.S.C. § 706(2)(A) (Count II), and that ED exceeded its statutory authority, in violation of 5 U.S.C. § 706(2)(C) (Count III). UCSA argues that emergency relief is needed because its members “are suffering, and will continue to suffer, irreparable injury” from ED's allowing DOGE staffers access to members’ data. Dkt. 9 at 40. UCSA avers this injury “cannot be remedied after the fact” through damages. Id. at 42.

II. ANALYSIS

A temporary restraining order (“TRO”) is “an extraordinary form of relief.” Banks v. Booth, 459 F. Supp. 3d 143, 149 (D.D.C. 2020). A TRO is analyzed using the same “factors applicable to preliminary injunctive relief,” and “may only be awarded upon a clear showing that the plaintiff is entitled to such relief.” Id. (quoting Sherley v. Sebelius, 644 F.3d 388, 391 (D.C. Cir. 2011)). To obtain a TRO, a movant “must show that (1) it is likely to succeed on the merits; (2) it is likely to suffer irreparable harm in the absence of preliminary relief; (3) the balance of equities tips in its favor; and (4) the issuance of a preliminary injunction is in the public interest.” Alpine Sec. Corp. v. FINRA, 121 F.4th 1314, 1324 (D.C. Cir. 2024) (internal quotations and alterations omitted).

Although “the movant has the burden to show that all four factors, taken together, weigh in favor of the injunction,” Abdullah v. Obama, 753 F.3d 193, 197 (D.C. Cir. 2014) (quoting Davis v. Pension Benefit Guar. Corp., 571 F.3d 1288, 1292 (D.C. Cir. 2009)) (internal quotation marks omitted), “the basis of injunctive relief in the federal courts has always been” the second factor—“irreparable harm.” Chaplaincy of Full Gospel Churches v. England, 454 F.3d 290, 297 (D.C. Cir. 2006) (quoting Sampson v. Murray, 415 U.S. 61, 88, 94 S.Ct. 937, 39 L.Ed.2d 166 (1974)). “[A] showing that irreparable harm is ‘likely’ is [thus] the sine qua non for obtaining [a TRO]—it is what justifies the extraordinary remedy of granting relief before the parties have had the opportunity fully to develop the evidence and fully to represent their respective cases.” Cal. Ass'n of Private Postsecondary Schs. v. DeVos, 344 F. Supp. 3d 158, 167 (D.D.C. 2018) (quoting Achagzai v. Broad. Bd. of Governors, No. 14-cv-768, 2016 WL 471274, at *3–4 (D.D.C. Feb. 8, 2016)). It follows that “[a] movant's failure to show any irreparable harm is therefore grounds for refusing to issue” a TRO, “even if the other three factors entering the calculus merit such relief.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297; see also Ashland Oil, Inc. v. F.T.C., 409 F. Supp. 297, 309 (D.D.C.), aff'd, 548 F.2d 977 (D.C. Cir. 1976) (“If irreparable injury cannot be established, ․ injunctive relief is not warranted.”).

The Court, accordingly, starts by considering whether UCSA has made a “clear showing” that “it will likely suffer irreparable harm” in the absence of emergency injunctive relief. Singh v. Berger, 56 F.4th 88, 95 (D.C. Cir. 2022). Because the Court concludes that UCSA has failed to clear that essential hurdle, the Court's analysis also ends there. The Court leaves for another day consideration of whether USCA's has standing to sue and has stated a claim upon which relief may be granted. Those questions are less clear cut and are better answered on a more complete record.³

The D.C. Circuit “has set a high standard for irreparable injury.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297. It “must be both certain and great,” “actual and not theoretical,” and “beyond remediation.” Id. (quoting Wisc. Gas Co. v. F.E.R.C., 758 F.2d 669, 674 (D.C. Cir. 1985)). UCSA avers that it has met this high bar. On UCSA's telling, its members “are suffering, and will continue to suffer, irreparable injury” due to ED's making their data “accessible” to DOGE staffers. Dkt. 9 at 40. UCSA observes that once information is “disseminat[ed],” it cannot be contained—the proverbial cat is out of the bag. Id. at 40–42. UCSA reasons that this “ongoing injury” of “exposure” of their data “cannot be remedied after the fact.” Id.

UCSA is correct that a disclosure of information generally cannot be “undone,” id. at 43, but that is not sufficient to show irreparable harm. What UCSA overlooks is that the context of the dissemination matters. Courts find dissemination of information to be an irreparable injury where, for example, highly sensitive information will be made public, or ends up in the hands of someone with no obligation to keep it confidential. Indeed, the cases upon which UCSA relies recognize this principle. See id. at 42 (citing Hospitality Staffing Sols., LLC v. Reyes, 736 F. Supp. 2d 192, 200 (D.D.C. 2010) (finding “disclosing [defendant's] confidential and proprietary information” to competitors would be “irreparable”); then citing Wilcox v. Bastiste, No. 17-cv-122, 2017 WL 2525309, at *1–3 (E.D. Wash. June 9, 2017) (finding irreparable injury where state agency was “sell[ing] [automobile] collision reports to any third party without redacting various types of personal information”)); see also Dkt. 17 at 31 (citing United States v. Miami University, 294 F.3d 797, 803, 817–19 (6th Cir. 2002) (finding disclosure of student disciplinary records “and the personally identifiable information contained therein” to a newspaper would cause irreparable harm)).

And, by the same token, courts have declined to find irreparable injury where the challenged disclosure is not “public,” but involves individuals obligated to keep it confidential. See, e.g., Ashland Oil, Inc., 409 F. Supp. at 308 (declining to find that disclosure of trade secrets to congressional subcommittee would cause irreparable harm because it would “not lead inexorably to either public dissemination or disclosure”); Baker DC v. Nat'l Lab. Rels. Bd., 102 F. Supp. 3d 194, 203 (D.D.C. 2015) (declining to find that employees would suffer irreparable harm from disclosure of their personal information to a union because regulations placed “limits” on the union's use of the information). Here, the Ramada declaration attests that the six employees at issue “understand that—like all Department of Education employees—they must comply with all applicable laws and regulations should they wish to share any information garnered during their work,” Dkt. 16-1 at 4 (Ramada Decl. ¶ 16), and he attests that, to his knowledge, none of the information at issue has been shared with any other “DOGE-affiliated individuals,” Dkt. 18-2 at 3 (Supp. Ramada Decl. ¶ 7). He further attests, moreover, that none of the six employees at issue will access “any tax-related information” without first obtaining the “appropriate authorization,” and even then, those employees will access the information only “for purposes consistent with applicable law, such as conducting analyses to estimate costs related to student loan repayment plans, awards, or debt discharges.” Dkt. 16-1 at 3 (Ramada Decl. ¶ 11). Notably, all of the “applicable laws and regulations,” which Ramada attests the six employees will follow, impose strict limits on the use and disclosure of Privacy Act protected records and tax return information, and they impose criminal penalties and potential civil liability on those who willfully ignore their obligations.

UCSA, in contrast, cites no authority for the proposition that mere “access” to personal data by government employees who are not formally authorized to view it, without more, creates an irreparable injury. Perhaps implicitly recognizing this infirmity, UCSA suggests that emergency relief is nonetheless needed to prevent future injuries. UCSA argues that there is a “risk” of “identity theft,” a “risk” of “further dissemination” of their data, and a “risk” that ED will “share[ ]” members’ data with other agencies to use for “immigration enforcement.” Dkt. 9 at 33, 40. These harms, however, are entirely conjectural. UCSA provides no evidence, beyond sheer speculation, that would allow the Court to infer that ED or DOGE staffers will misuse or further disseminate this information.⁴ Moreover, “the courts must presume” that the government will exercise its powers “responsibly” and with “due regard” to affected individuals. Ashland Oil, Inc., 409 F. Supp. at 308. This “presumption of regularity supports the official acts of public officers, and, in the absence of clear evidence to the contrary, courts presume that they have properly discharged their official duties.” United States v. Chem. Found., 272 U.S. 1, 14–15, 47 S.Ct. 1, 71 L.Ed. 131 (1926).

ED and DOGE staffers are obligated to use UCSA members’ information for lawful purposes within the mission of the Department of Education and to keep it confidential, in accordance with the Privacy Act, tax laws, and other federal laws. Ramada attests that he and the other DOGE-affiliated employees had access to ED's systems, “to audit those programs for waste, fraud, and abuse,” Dkt. 16-1 at 3 (Ramada Decl. ¶ 9), and to identify “contracts and grants that are ․ inconsistent with leadership's policy priorities,” Dkt. 18-2 at 3 (Supp. Ramada Decl. ¶ 8). But none of those initiatives should involve disclosure of any sensitive, personal information about any UCSA members. The future injuries that UCSA's members fear are, therefore, far from likely, let alone “certain” and “great.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297.

Finally, the remedies provided in the Privacy Act and the Internal Revenue Code confirm that UCSA's members are not suffering (and will not suffer) an irreparable harm. In general, injuries are not “irreparable” if there is a “possibility” that “adequate compensatory or other corrective relief will be available at a later date.” Chaplaincy of Full Gospel Churches, 454 F.3d at 297 (quoting Wisc. Gas Co., 758 F.2d at 674); see Richards v. Delta Air Lines, Inc., 453 F.3d 525, 531 n.6 (D.C. Cir. 2006) (“The general rule is that injunctive relief will not issue when an adequate remedy at law exists.”). Here, both the Privacy Act and the Internal Revenue Code provide a private right of action and money damages for certain unauthorized disclosures. See 5 U.S.C. § 552a(g)(4) (authorizing civil penalties for violation of the Privacy Act); 26 U.S.C. § 7431(a) (authorizing civil penalties for violation of § 6103). To the extent UCSA members have been injured by violations of these statutes, and they meet the other requirements for obtaining relief, there is at least a “possibility” of compensatory relief at a later date.

CONCLUSION

For the reasons explained above, UCSA's motion for a temporary restraining order, Dkt. 9, is DENIED.

SO ORDERED.

FOOTNOTES

1.   “Authorized person” is defined as “an officer, employee, or contractor, of the Department of Education, [who] is specifically authorized and designated by the Secretary of Education” to access the data for a specified purpose. 26 U.S.C. § 6103(l)(13)(E).

2.   The United States Digital Service was established in 2014 following the launch of Healthcare.gov, with the purpose of “using design and technology to deliver better services to the American people” and “repair[ing] and improv[ing] the federal government's information technology and data organization systems.” U.S. Digital Service, https://perma.cc/B8QZ-NFYV; Dkt. 16-1 at 1 (Ramada Decl. ¶ 2).

3.   The Court must, of course, consider whether it has jurisdiction at each successive stage of the proceeding, requiring “the manner and degree of evidence” that courts typically demand at the relevant stage. Lujan v. Defs. of Wildlife, 504 U.S. 555, 561, 112 S.Ct. 2130, 119 L.Ed.2d 351 (1992). Here, however, ED has not filed a motion to dismiss, and, because the Court will deny UCSA's motion for a TRO, the Court need not consider whether UCSA has carried its further burden of demonstrating that it likely has standing to sue, see Nguyen v. U.S. Dep't of Homeland Sec., 460 F. Supp. 3d 27, 33 (D.D.C. 2020). Nor can the Court conclude on the present record that UCSA's theory of standing—including its contention that its members face an imminent threat of injury analogous to that protected by the common law tort of intrusion upon seclusion—is so implausible that the Court lacks authority even to consider UCSA's motion.

4.   When asked at oral argument whether there was “any reason to believe this [information] is being used for immigration purposes,” counsel for UCSA conceded that there was not. Hrg. Tr. (Rough at 10). Given Defendants’ representations to the Court regarding how the DOGE-affiliated employees intend to use the information at issue, and the Court's reliance on those representations, the Court would expect Defendants promptly to notify the Court should those representations prove inaccurate or incomplete. As the record now stands, however, the Court has no reason to believe that any of the information at issue will be used for any purpose unrelated to the statutory mission of the Department of Education itself.

RANDOLPH D. MOSS, United States District Judge