Stanford Law Professors Pam Karlan and Mark Lemley discuss privacy protections of the nation’s largest collection of personal data, unprecedented influence of Silicon Valley in Washington, and the notion of an imperial presidency

A coalition of privacy defenders led by the law firm Lex Lumina and the Electronic Frontier Foundation filed a lawsuit on February 11 asking a federal court to stop the U.S. Office of Personnel Management (OPM) from disclosing millions of Americans’ private, sensitive information to Elon Musk and his “Department of Government Efficiency” (DOGE). As the federal government is the nation’s largest employer, the records held by OPM represent one of the largest collections of sensitive personal data in the country.

Is this important? Should Americans care? Here, Professor Pam Karlan, co-host of the Stanford Legal podcast, discusses these issues with her colleague Professor Mark Lemley, an expert in intellectual property, patent law, trademark law, antitrust, the law of robotics and AI, video game law, and remedies for a recent episode. Lemley is of counsel with Lex Lumina and closely involved in the DOGE case.

The conversation overviews urgent privacy concerns that led to the lawsuit, laws such as the Privacy Act, and legal next steps for this case. They also look at the current political landscape, highlighting increased influence of Silicon Valley, particularly related to Musk’s DOGE. They also touch on the demise of the Chevron doctrine and the possible rise of an “imperial presidency,” drawing parallels between a consolidation of power at the Supreme Court and the executive branch—and how Lemley’s 2022 paper, “The Imperial Supreme Court,” predicted the rise of the Court.

The following is an edited and shortened version of the full podcast transcript, which can be found here.

Pam Karlan: Your lawsuit is one of the many lawsuits involving the Trump administration and its attempts to remake what we understand the government to be. But first, what is DOGE?

Mark Lemley: Well, nobody really knows the answer to that question. But Elon Musk has been obsessed with various things, one of which is Dogecoin, which is a form of cryptocurrency that’s been around for a little while. And I think he decided as part of his penchant for puns he thinks are clever, that he should run the Department of Governmental Efficiency, which appears to be neither a department nor about governmental efficiency, but which he could nicely abbreviate to DOGE.

Listen to the Podcast

Pam Karlan: The government is now, in a different lawsuit, taking the position that Elon Musk doesn’t run DOGE, because if he did run DOGE, that would be a problem for him. On the other hand, they won’t tell us who is running it. But while these people are “not” running the government, what did they do that led to your lawsuit?

Mark Lemley: There is a Schrödinger’s cat nature to this entity. It is a government entity when we want it to be and not a government entity otherwise. That is going to feature in this lawsuit.  What precipitated our lawsuit was that a number of people who purportedly work for DOGE, who used to work for Elon Musk’s companies, and might or might not now work for the government, came into the Office of Personnel Management and demanded administrative access to all of its computer records. That means access to the social security numbers, age, gender identity, health and a variety of other information kept in personnel records for all federal government employees and all former federal government employees.

Pam Karlan: And what reason is there for getting this information?

Mark Lemley: It’s a good question. And the government hasn’t articulated an answer. Things they seem to have done with this information include sending an email to everybody in the government offering them a buyout, which is the subject of a separate lawsuit and might or might not be legal. So, they got access to everybody’s email in one place.

And we’ve seen fallout from this so far, including across-the-board firings in various departments. For instance, the government fired everyone whose status in the government was probationary. We don’t know why they did that, but it’s possible that they thought probationary meant these were low performers and should be fired.

Pam Karlan: It just means you’re in your first two years of government service, right?

Mark Lemley: Maybe they wanted to do that—it’s an easy way to identify and get rid of all of the Biden administration hires. But it turns out that among other things, probationary employees also include those who’ve been around for a long time, done a great job, and have been promoted to a new position in a new department. And so, we ended up firing a bunch of people who have very critical jobs within the government. But I think they got that information from OPM. So, these people who purportedly work for DOGE came in and got computer access to all of the computer systems and all of the data.

Pam Karlan: And once they have access to this data, since we don’t really know the identity of the people working at DOGE, and it’s not clear what else they might use this data for, the idea that Elon Musk has access to all of this data and is also running a bunch of companies that depend on knowing a lot about people, it really does move us towards a kind of either 1984 or panopticon kind of society.

Mark Lemley: I think that’s right. And so, one very significant worry is what does Elon Musk and his employees, presumably his employees, again, the government now takes the position he doesn’t actually have any employees at the government, do with this information? And that could be things like illegally firing people. One of the things you can learn from this is transgender status. So, if you want to target people on the basis of protected category, you could do that. And we don’t know much about the people who are acquiring this information. One of them is 19 years old and goes by the online name, “Big Balls.” He was fired from a cybersecurity company, apparently for mishandling information.

The other set of worries is that once you’ve taken information out of a secure environment, it makes it much easier for anybody else, like the Chinese government or the Russian government, to hack it and get access to it. The DOGE folks do not appear to be following common cyber security practices. On the DOGE website itself, they used open programs so that anybody can go and modify the DOGE website.

Pam Karlan: You’re kidding.

Mark Lemley: Nope, I wish I was. They also emailed a list of CIA employees hired in the last two years over unencrypted email to the White House, where the identity of these people is itself something that could get them killed.

This is arguably the worst hack of the United States government in history. It’s worse than anything the Chinese have done. We’ve now made this information insecure and it’s going to be hard to get it back.

Pam Karlan: Your lawsuit uses a federal statute called the Privacy Act. Can you tell us a little bit about the theory of the lawsuit and what you’re looking for?

Mark Lemley: The Privacy Act was passed in 1974, and it governs the behavior of agencies who have information about individuals. A core provision of the Act is that just because the government has information about you in one agency, that doesn’t mean you can share it with anybody else in the government.

The Privacy Act says the agency can use this information for its own purposes, but it can’t share it outside the agency unless it meets one of a specified set of exceptions. There’s a national security exception. There’s anonymized data for census and polling information. There are various exceptions, none of which seem to apply here.

And so, our argument in the lawsuit is straightforward, which is OPM has a right to access this data. DOGE, whatever it is, is not part of OPM, and it doesn’t have a right to access this data under the Privacy Act unless it meets one of those exceptions. And there’s no exception that I think can plausibly apply here. None of it could plausibly require access to every current and former government employee, which is something like 20 million people.

Pam Karlan: You could imagine a fair number of the exceptions under the Privacy Act where, say, the State Department wants data about government employees who are in particular countries or the like. But this DOGE case does seem to be about all the data of any kind about anyone who’s ever worked for the government, which I assume includes us because we were both law clerks.

Pam Karlan: As you say in the complaint, it’s things like, “who’s your health insurance provider?” “What kinds of claims have you made?” “Who else is a family member, and the like?” All of that in the data.

Mark Lemley: So, two things that are notable about the Privacy Act. One:  it is not a defense that you wanted to use the data for a lawful purpose. If you disclose the information outside the agency, and not for one of these specified purposes, that’s a violation of the Privacy Act. So, for our lawsuit, it doesn’t matter what, if anything, they do with the information. We don’t have to prove that they have abused this information or that this breach has caused a hack in order for there to be a Privacy Act violation.

Pam Karlan: And the Privacy Act has damages provision in it, right?

Mark Lemley: Yes, and that’s the second interesting thing. It has a damages provision and if you willfully violate it, and I think it’s pretty hard to argue they didn’t deliberately get access to this information, the statute says there are minimum statutory damages of $1,000 per person.

Now, the Supreme Court, in an opinion by Justice Alito some years back in FAA v. Cooper, decided to abandon any plain meaning of the statute and graft on a new requirement that in order to be eligible for the thousand-dollar minimum statutory damage, you must have suffered some sort of financial injury.

So, our lawsuit right now is a lawsuit on behalf of the unions and some individuals seeking injunctive relief to stop the disclosure of the information and to require the people who wrongfully have access to information to delete it. But there will be another lawsuit, a class lawsuit on behalf of current and former federal government employees, for injuries they may have suffered. And so, if you are a current or former federal government employee, and you had to get credit monitoring or some sort of watch notice for your social security, if you were fired as a result of access to this information, all of these people have a damages action. And even if you paid only a small amount of money, I think you have a damages action with a minimum of $1,000.

Pam Karlan:  If you were fired as a result of this data being turned over to DOGE, would you have a damages claim with the $1,000, even if they were otherwise entitled to fire you?

Mark Lemley: I think that’s an interesting question. And I don’t know the answer to that question yet. What the Court said in FAA v. Cooper is you must have suffered some monetary injury because of the Privacy Act violation.

Pam Karlan: But presumably without the data, it might have taken them until May or June or July to figure this out otherwise.

Mark Lemley: Exactly. At a minimum, you’ve suffered the injury of losing three months’ salary or whatever you would have suffered. Those damages may be more than a thousand dollars.

Pam Karlan: I assume there are going to be similar lawsuits filed with regard to DOGE getting access to everybody’s tax records, which apparently led to the resignation of the top career Treasury employee who was in charge of the IRS’s databases because he was unwilling to hand this over to “Big Balls” and whoever else is working with him.

Mark Lemley: And the same thing happened over the weekend with the head of the Social Security Administration, who resigned rather than disclose data.

We think this lawsuit is important, especially if you are a current or former federal government employee, but it is one piece of a mosaic that is challenging the rampant pillaging of private government databases, not only databases about federal employees, but databases about every citizen in the United States.

Pam Karlan: So troubling. I’d like to turn to an article of yours that wasn’t in your normal field of expertise, which is intellectual property, where you are the most-cited legal scholar in the country and also the most influential. Those two things do not always go together, but they do with you. And that’s a piece you wrote in the Harvard Law Review that was called “The Imperial [Supreme] Court,” in 2022, which turns out to be even more true in some ways today. What struck me when I was preparing to talk to you today is what we’re now seeing are moves on behalf of the executive branch that look very similar to what you described about the Supreme Court and its transformation to an “imperial court.”

Mark Lemley: I wrote “The Imperial Supreme Court” because I’d seen a variety of moves by the Court that didn’t seem to have any overarching ideological or methodological reason to them, except that the Court got to do what the Court wanted.

And so, rather than taking power away from the federal government and giving it to the states or taking power away from the government and giving it to the people or taking power away from the executive branch and giving it to Congress, the Court would move in any direction it wanted to as long as it got the result that it wanted. And it ended up, I think, aggregating a lot of power to itself, and that struck me as a problem.

Pam Karlan: One of the things that has happened since then was what you perfectly predicted: the demise of the so-called Chevron doctrine, and the Court announcing that it, and it alone, was capable of interpreting federal statutes in a kind of definitive way.

Mark Lemley: And that’s going to be a very interesting thing to play out in the Trump administration because, while I think we have seen the rise of the imperial Supreme Court, we are now seeing the rise of the imperial presidency. Just in the last 72 hours, Elon Musk and his Donald Trump have issued orders saying essentially only they can determine what the law is. And issuing orders saying there will be no more independent federal agencies.

Pam Karlan: I noticed that.

Mark Lemley: Both of those things are clear efforts to try to consolidate power and that may bump up against the Court’s effort to consolidate power when it comes to lawmaking. It’s a little ironic to me because I lamented the fact that the Supreme Court is breaking the system of checks and balances, but the imperial nature of the Supreme Court may be the last hope we have left to defend ourselves against an imperial presidency.

We’ll see what happens. Recent history is not encouraging. They [the justices] seem perfectly happy to give Donald Trump immunity from prosecution, for instance, notwithstanding history or the way the laws are written. And it may be that blowing up the Chevron doctrine and saying, “We are the final arbiter” is going to mean in practice only that we blow up liberal interpretations of agency rules and not conservative interpretations.

But I think we’re going to see a real test of whether the Supreme Court will try to hold on to the power it has conferred to itself when it is asked to rule on actions by the Trump administration that’s trying to consolidate its own power.

Pam Karlan: The President is also taking funds that Congress has appropriated and saying they can’t be spent—suspending grants and the like. Many years ago, the Supreme Court upheld a restriction on the President’s impoundment power, but the new director of the Office of Management and Budget announced he doesn’t think the Impoundment Control Act is constitutional, and he thinks Trump doesn’t think so either. We’ll see what the Court has to say, but we’re not hearing anything out of Congress, which seems utterly supine at this moment. But we’re going to be hearing a lot from the people who were supposed to be getting these grants.

Mark Lemley: That’s right. I think one way this plays out is through a confrontation between the administration and the Court, which has made very clear that many of the things that Musk is doing are flatly illegal. But when the Court gets those challenges what does it do? Does it simply strike them down?

And then what happens if, as I think is a very real risk probably for the first time in my lifetime, the President just ignores the Court? We will see that with the impoundment of funds, and I also think we’re going to see it with the independent agencies—agencies that were imbued by law with independence.

They are telling Congress that, by executive order, they can undo an act of Congress. The Court will have to decide whether it was ever constitutional to pass those agencies. But even for an activist Supreme Court, it is a pretty broad lift to say a dozen agencies that have been around for 100 years or so, all turn out to have been unconstitutional and we just didn’t notice, notwithstanding the 100 or so cases we have adjudicated involving those agencies.

So, I think we’re headed for that sort of a confrontation. I do want to emphasize something you said about Congress. What we have seen is a rather remarkable willingness by Republicans in Congress to do whatever Trump wants, even people who in the past we might have said were moderate Republicans. One of the things we’ve seen is that the era of the moderate Republican in Congress is just over. They don’t exist.

And I think this is a pattern we’ve seen for the last eight years, the only people who seem willing to stand up to Donald Trump are the ones who are on their way out the door.

And so, when Mitch McConnell is leading the sane Republican opposition to Donald Trump, and he’s the only one in that group, you know things have shifted. My hope, honestly, if there is a hope, is that a number of those Republicans start hearing from really pissed off Republican constituents, who lost their jobs in the federal government, who can’t get into a national park, who can’t get their social security check, who can’t get disability or health benefits because the “Musk administration” has decided to move fast and break things without looking at what it was breaking or what it might cost people.

Pam Karlan: Washington has traditionally been slow, and the disadvantage of the bureaucracy is it’s slow to change and move, but the advantage of the bureaucracy is it’s sometimes slow to change and move. We’re seeing an injection of a particular form of Silicon Valleyism into Washington with the, as you say, Musk administration. You have had more exposure perhaps than almost anybody to Silicon Valley and the thinking in Silicon Valley. How do you assess this?

Mark Lemley: I think there are a couple of things going on here. The billionaires who run successful Silicon Valley companies really do have a power over their organization that no U.S. President has ever had over the government. And so, I think Elon Musk comes in, whatever role or non-role he has, and says, “do it,” and he expects that it will be done and never mind that it might be illegal—never mind that there might be a process to be followed.

I think Silicon Valley has succeeded in various ways by, as they say, “moving fast and breaking things,” because it has enabled them to sort of fix inefficiencies that were in fact real problems that you could fix. But they’ve also screwed things up horribly in various circumstances.

And so, the problem with moving into a new area where you are not an expert is there might be a reason that thing is there and if you just take it down, if you just tear it down, you might find out to your detriment that, oh yeah, we actually needed the people in, for example, the FAA who were doing airplane safety.

Pam Karlan: Yeah, or we shouldn’t just run some program that gets rid of the word “equity” everywhere it appears, and now the mortgage sites of the federal government won’t talk about how to deal with home equity.

Mark Lemley: Elon Musk is in many respects, the worst of Silicon Valley. He is the most arrogant combined with the least domain knowledge. To think he can parachute in, look at a Social Security database and conclude that 80 percent of the people in the database are actually dead and getting checks fraudulently because he doesn’t understand the programming language that was used to write it and how it triggers dates and so that it defaults to 150 years old. That’s the bad thing about Silicon Valley. I’ll add that in the private sector, if you do something stupid, somebody else will come in and beat you at your own game, or people don’t buy your product anymore. We can’t do that with the government.

Pam Karlan: I couldn’t have said it better. Thanks so much Mark.

Mark Lemley is the William H. Neukom Professor of Law at Stanford Law School and the Director of the Stanford Program in Law, Science and Technology. He is also a Senior Fellow at the Stanford Institute for Economic Policy Research and is affiliated faculty in the Symbolic Systems program. He teaches intellectual property, patent law, trademark law, antitrust, the law of robotics and AI, video game law, and remedies.