Federal employees affected by a data breach can sue under the Privacy Act of 1974, pursue claims through class-action settlements, and receive agency-funded credit monitoring, but each path has real limits. The Privacy Act (5 U.S.C.
§552a(g)) lets an employee seek damages when an agency's intentional or willful mishandling of records causes actual harm, and courts have let such suits proceed even when the breach involved outside hackers rather than agency staff. These rights developed largely in response to the 2015 Office of Personnel Management (OPM) breaches, which exposed personnel records on millions of federal workers and became the test case for what the government owes employees afterward. What happened next — from a disputed settlement fund to a looming end date for free protection — shows both what employees can claim and where those claims tend to fall short.
Table of Contents
- What the Privacy Act Actually Allows
- What a Class-Action Settlement Can Actually Pay
- What Agencies Are Required to Do Before and After a Breach
- Credit Monitoring and Identity Protection — and Its Expiration Date
- A Legislative Fix Is Pending, Not Passed
- Frequently Asked Questions
What the Privacy Act Actually Allows
The Privacy Act gives federal employees a legal route to sue their own agency when it mishandles personal records, but the bar is high. DOJ's overview of the Privacy Act explains that a plaintiff must show the agency acted intentionally or willfully, not merely negligently, and must prove actual damages before collecting even the $1,000 statutory minimum — a standard the Supreme Court set in *Doe v. Chao* (2004). That requirement matters because most data breaches trace back to a security failure rather than a deliberate act by an agency employee.
The same DOJ overview, citing *Doe v. Chao*, notes that a negligent security lapse alone generally does not support a damages claim, which leaves most affected workers unable to collect money through this route and limited instead to whatever credit-monitoring benefits the agency offers. Separately, the standing question — whether an employee can even bring such a suit — was itself contested. The D.C. Circuit ruled in 2019 that federal employees had Article III standing to sue OPM over its handling of their data, reviving union-led lawsuits that combined Privacy Act, FISMA, common-law negligence, and constitutional due process claims.
What a Class-Action Settlement Can Actually Pay
Beyond individual Privacy Act suits, affected employees can also recover money through class-action settlements tied to a specific breach. A federal judge gave final approval in October 2022 to a $63 million settlement covering the 2014–2015 OPM breaches and a related breach at contractor Peraton, letting claimants who proved an out-of-pocket loss or lost time protecting their identity collect between $700 and $10,000 each.
That dollar figure, though, overstates what most employees actually received. Govexec reported in January 2025 that OPM and Treasury had paid only about $4.8 million to roughly 5,000 claimants — leaving about $58 million of the fund to revert to the U.S. Treasury instead of reaching affected employees.
- A settlement fund existing does not mean most eligible people filed a claim or received payment.
- Documentation requirements — proof of an out-of-pocket loss or time spent on identity protection — kept many claims from being paid.
- Unclaimed settlement money in federal breach cases has gone back to the Treasury rather than being redistributed to the class.
What Agencies Are Required to Do Before and After a Breach
Federal agencies carry their own set of obligations independent of what an employee can sue for. OMB Memorandum M-17-12, issued in January 2017, requires every federal agency to maintain a breach response plan with a dedicated response team, to assess and report any breach involving personally identifiable information, and to require contractors handling employee data to encrypt it and notify the agency of incidents.
These requirements exist because the OPM breach exposed major gaps in how agencies handled contractor-held data and incident reporting. An employee whose agency failed to follow these response-plan and reporting obligations has a stronger factual basis for the "intentional or willful" showing the Privacy Act demands, even though the memorandum itself does not create a private right to sue.
Credit Monitoring and Identity Protection — and Its Expiration Date
After the 2015 OPM breach, which exposed personnel data on 4.2 million current and former employees and background-investigation and fingerprint data on 21.5 million people, OPM initially offered those affected only 18 months of free credit monitoring and $1 million in identity-theft insurance — a response widely seen as inadequate given the scale of the exposure. Congress later extended that coverage, but it runs on a fixed clock. The free credit-monitoring and identity-protection coverage is scheduled to end no later than September 30, 2026, ten years after each person's enrollment, after which affected employees lose the government-funded protection unless Congress acts.
- Check enrollment dates now: coverage ends on a ten-year clock from individual enrollment, not a single fixed date for everyone.
- Budget for private credit monitoring or identity-theft insurance as a fallback once agency-funded coverage lapses.
- Watch for agency notices about replacement coverage, since no permanent extension has been enacted as of this writing.
A Legislative Fix Is Pending, Not Passed
Lawmakers have introduced a bill to address the looming expiration, but it has not become law. Sen. Mark Warner introduced the bipartisan RECOVER PII Act (S.
5217) on August 3, 2026, with a companion bill in the House, proposing to convert the expiring OPM breach coverage into lifetime identity-theft monitoring and raise the insurance minimum to at least $5 million. The bill remains in committee with no floor vote scheduled. Employees relying on current protections should treat the September 2026 expiration as the operative deadline unless and until this legislation — or something like it — actually passes.
Frequently Asked Questions
Can a federal employee sue just because their agency had a data breach?
Not on negligence alone. The Privacy Act requires proof the agency acted intentionally or willfully and that the breach caused actual, provable harm, per DOJ's overview.
Is the $63 million OPM settlement still open to new claims?
The settlement received final approval in October 2022, and Govexec reported that most of the fund had already reverted to the Treasury by January 2025.
What happens to OPM breach victims' credit monitoring after September 2026?
Coverage ends on a ten-year clock from each person's enrollment, with a final cutoff no later than September 30, 2026, unless Congress passes an extension like the pending RECOVER PII Act.
You Might Also Like
- Pentagon Data Breach: What Government Employees Should Do Next
- Will Banks Compensate Customers After a Financial Data Breach?
- How Much Does Credit Monitoring Cost After a Medical Data Breach?