A US court rules OPM broke the law sharing millions of federal workers' data with DOGE. EU operators, this is what ungoverned AI access looks like.
elcome to issue twenty-six. This week the US federal court system delivered a landmark ruling: sharing millions of civil servants' personal records with DOGE agents was flatly unlawful, and a judge said so in writing. Closer to home, a PHP vulnerability briefly took down roughly 70% of the internet and reminded every operator that open-source infrastructure underpins almost everything AI touches. We also have EFF's new push to rein in automated licence plate surveillance, a story with direct echoes in the EU AI Act's rules on real-time biometric identification in public spaces.
Let’s go.
yours, Flux
Flux Weekly is a 6-minute briefing for people who have to actually make AI work in Europe. Sole traders to enterprise, one issue every Friday morning.
- New We added the OPM-DOGE ruling to our Data Governance case study library as a reference point for documenting lawful basis in AI data pipelines.
- Updated Our open-source dependency checklist has been updated to flag PHP-based components following this week's critical vulnerability disclosure.
- ICYMI EFF's new Online Privacy for Parents and Youth guide is free and offers a solid framework for any operator thinking about age-verification obligations under the EU AI Act.
US Federal Court Rules OPM's Disclosure of Millions of Civil Servant Records to DOGE Agents Was Unlawful
What actually happened. On 20 October 2026, a New York federal court issued a summary judgment finding that the Office of Personnel Management violated two separate provisions of the Privacy Act when it handed over millions of federal employee records to DOGE agents. The court found both the inter-agency disclosure and the manner of access to be unlawful, marking one of the clearest judicial rebukes yet of DOGE's data activities.
Why this matters beyond US borders. For EU operators, the ruling is a case study in what happens when AI-adjacent data access happens without governance guardrails. DOGE agents were given access to sensitive personnel data with no auditable legal basis. The EU AI Act, combined with GDPR, is specifically designed to prevent exactly this pattern: uncontrolled access to large personal datasets feeding automated decision-making systems, with no documented purpose limitation and no human accountability trail.
Does your AI inform a decision that affects a person's job, credit, education, or essential service?
- ✓No major new EU AI Act implementing measures published this week, but the OPM ruling strengthens the case for the Act's data governance requirements.
- ✓The PHP 'Vulnerability Apocalypse' exposed how deeply EU operators depend on open-source infrastructure with no mandatory security funding model.
- ✓EFF's call for open-source funding resonates with the EU AI Act's obligations around robustness and cybersecurity for high-risk AI systems.
- ~US: Federal court rules OPM's bulk data disclosure to DOGE unlawful under two Privacy Act provisions, issued as summary judgment on 20 October 2026.
- ~
- 1EFF Surveillance Self-Defense: Parents and YouthGuide
A plain-English guide from EFF covering online privacy threats and practical mitigations for families and younger users.
Why we like it. The framework for layered privacy protection it outlines maps neatly onto the EU AI Act's transparency obligations for systems that interact with minors.
- 2Privacy Badger for Safari (macOS)Tool
EFF's free, open-source tracker-blocking browser extension, now available on Safari version 26.5 and above.
Why we like it. If your team uses Safari and you have even basic web-tracking compliance concerns, this is a free five-minute fix with more than 4 million existing users.
- 3EFF's ALPR State Legislative Agenda
The OPM ruling is the compliance case study I have been waiting to use in every sales call
By John Ferguson
I have spent more time than I care to admit trying to explain to operators why data governance documentation is not bureaucratic theatre. This week, a federal court handed me the clearest possible illustration: millions of records, no paper trail, and a summary judgment that says 'unlawful' in plain terms.
The defence I hear most often is 'we trust the people we work with.' The OPM case is a reminder that trust is not a lawful basis. Courts do not accept 'but they seemed fine' as a substitute for a documented data-sharing agreement with purpose limitation attached.
For EU operators, the good news is that GDPR and the AI Act together create a framework that would have caught this before it reached a courtroom. Data protection impact assessments, records of processing activities, and access controls are not optional extras. They are the paper trail that makes a legal defence possible.
This week I am updating our own vendor access review template to include an explicit 'what can this party do with this data' column. If the answer is 'whatever they like,' that vendor relationship needs a conversation before it needs a judge.
John Ferguson · Founder, Agentic Fluxus
Short answer.Because the fact pattern is universal: a large dataset of personal records was shared with a technically capable third party without a documented lawful basis, and a court later called that unlawful. If your AI vendor, subprocessor, or internal analytics team accesses personal data without a clear, documented purpose, you face the same exposure under GDPR and the AI Act's data governance requirements. The geography changes; the risk pattern does not.
Does your organisation have a documented lawful basis for every personal dataset your AI systems can access?
A New York federal court found on 20 October 2026 that OPM violated two separate Privacy Act provisions when it handed millions of civil servant records to DOGE agents. No documented inter-agency agreement, no purpose limitation, no audit trail.
A critical PHP vulnerability briefly took down a significant share of the web this week, exposing how much of the internet runs on a single open-source codebase with no guaranteed maintenance funding. AI systems sitting on top of PHP-based infrastructure were caught in the blast radius.