NTEU has filed a lawsuit against OPM in the U.S. District Court for the Northern District of California in connection with last month’s sweeping data breaches, which exposed the personal information of millions of federal employees. In addition to basic information typically found in personnel files, background investigation materials for current, former, and prospective federal employees were also compromised. Those materials include inherently private information provided by individuals who put their trust in OPM to keep that information confidential.

As its own Inspector General has made clear, OPM failed, for years, to implement security measures that would sufficiently safeguard this personal information. As NTEU’s lawsuit alleges, OPM’s failure to safeguard the personal information entrusted to it permitted hackers to access that information.

NTEU’s lawsuit asserts that, by failing to protect their personal information from unauthorized disclosure, OPM violated NTEU members’ constitutional right to informational privacy. The lawsuit seeks a number of remedies aimed at righting OPM’s wrongs and preventing future harm.  In particular, it asks the court to:

• Declare that OPM’s failure to protect NTEU members’ personal information was unconstitutional;
• Order OPM to provide lifetime credit monitoring and identity theft protection to NTEU members, at no cost to those NTEU members;     
• Order OPM immediately to take all necessary and appropriate steps to correct deficiencies in OPM’s IT security program so that NTEU members’ personal information will be protected from unauthorized disclosure; and
• Enjoin OPM from collecting or requiring the submission of NTEU members’ personal information in an electronic form until the court is satisfied that all necessary and appropriate steps to safeguard NTEU members’ personal information have been implemented.

We will keep you informed of notable developments in this important litigation.