The U.S. Court of Appeals for the D.C. Circuit largely sided with the American Federation of Government Employees and the National Treasury Employees Union in their lawsuit against the Office of Personnel Management and a federal contractor for their roles in the hacks that led to the disclosure of the personal records of 21.5 million individuals.
The Court of Appeals reversed the decision of a district court. The court said that AFGE and NTEU met the requirements for bringing the suit in federal court; AFGE stated a claim under the Privacy Act, which waives OPM’s sovereign immunity; (iii) and OPM's contractor KeyPoint is not protected by derivative sovereign immunity. The Court of Appeals sent the case back to the lower court, saying the court must hear the case on the merits.