UNITED STATES DISTRICT COURT
FOR THE DISTRICT OF COLUMBIA
DENISE NEMETH-GREENLEAF, et al.,
Plaintiffs,
v. Case No. 25-cv-407 (CRC)
UNITED STATES OFFICE OF
PERSONNEL MANAGEMENT, et. al.,
Defendants.
MEMORANDUM OPINION AND ORDER
The Court recently denied Defendants’ motion to dismiss this putative class action
alleging that the Office of Personnel Management (“OPM”) and Department of the Treasury
violated the Privacy Act by providing the Department of Government Efficiency (“DOGE”)
access to personal employee data. Defendants now urge the Court to reconsider that ruling.
They separately ask the Court to strike the class allegations from the complaint. The Court will
deny both requests. While Defendants point out an oversight in the Court’s earlier opinion,
correcting that error does not alter the result. And although Plaintiffs’ prospects for class
certification may seem slim, Defendants have identified no threshold legal defect that would
warrant the exceptional remedy of foreclosing class discovery altogether.
I. Background
The Court has already detailed this case’s factual and procedural history. See NemethGreenleaf v. OPM, No. 25-cv-407 (CRC), 2026 WL 607905, *1–3 (D.D.C. Mar. 4, 2026). It
recounts here only what is relevant to the present motion and what has transpired since.
In early 2025, five federal employees (“Plaintiffs”) sued OPM and the Department of the
Treasury (together, “Defendants” or “agencies”) under the Privacy Act, seeking damages on behalf of a putative nationwide class of “current, former, and prospective employees of the
United States whose personal sensitive information (‘PSI’) was accessed without their prior
written authorization from OPM and Department of Treasury beginning in January 2025.” First
Am. Class Action Compl. (“FAC”) ¶¶ 89, 101. Plaintiffs alleged that the agencies gave DOGEaffiliated workers sweeping access to systems containing sensitive employee information, even
though many of those workers allegedly lacked formal government-employment status, security
clearances, or relevant training. See id. ¶¶ 26–42. Each plaintiff claimed to have purchased
identity theft protection services as a precaution after learning about Defendants’ breaches of
their PSI from media reports. Id. ¶¶ 14–18. The complaint relies heavily on media reports—
published between DOGE’s creation and the filing of the suit—warning of both potential data
mishandling and an increased risk of future unauthorized disclosures or breaches. See, e.g., id.
¶¶ 30–42, 48 & nn.3–17, 21–22.
Defendants moved to dismiss for failure to state a claim. To recover monetary damages
under the Privacy Act, a plaintiff must show that (1) an agency intentionally or willfully violated
the Act; and (2) “as a result” of that violation, the plaintiff suffered “actual damages,” such as
“reasonably incurred out-of-pocket expenses” or other economic harm. In re U.S. Off. of Pers.
Mgmt. Data Sec. Breach Litig., 928 F.3d 42, 62, 65 (D.C. Cir. 2019); see 5 U.S.C.
§ 552a(g)(1)(D), (g)(4); Chichakli v. Tillerson, 882 F.3d 229, 233 (D.C. Cir. 2018). Defendants
took aim at the second element, arguing that Plaintiffs did not plead actual damages. NemethGreenleaf, 2026 WL 607905, at *7.
The Court disagreed. Plaintiffs’ purchase of identity theft protection services “appear[ed]
reasonable” given “contemporaneous public reporting on DOGE’s access to their data and its
possible mishandling of data elsewhere within the government.” Id. at *1. The Court reached
2
that conclusion after “drawing every reasonable inference” in Plaintiffs’ favor—including that
each plaintiff was aware of every report cited in the complaint that had been published before the
plaintiff bought identity protection.1 Id. at *8. And in light of reports and developments that
followed those purchases, the Court reasoned, Plaintiffs’ prophylactic “efforts to protect
themselves have . . . proven only more reasonable as time has passed.” Id. at *9.
Defendants have since answered, and the parties recently proposed a joint bifurcated
discovery plan. The first phase would consist of class-related discovery “limited to issues
necessary and relevant to addressing whether class certification is appropriate,” such as “whether
Plaintiffs can prove, via common evidence, the elements of their claims under the Privacy Act
and whether these common questions predominate over any potential individualized issues.”
Joint Statement Regarding Class Disc. at 4–5. Before phase one could get underway, however,
Defendants filed this present motion for reconsideration of the Court’s ruling on their motion to
dismiss or, in the alternative, to strike the complaint’s class allegations. See Defs.’ Mot. at 1–2.
Plaintiffs oppose.
II. Analysis
A. Motion for Reconsideration
A court may reconsider any interlocutory order “as justice requires.” Cobell v. Norton,
224 F.R.D. 266, 272 (D.D.C. 2004). But that phrase, broad as it sounds, is narrowly interpreted
in this District. See Bernier v. Trump, 299 F. Supp. 3d 150, 156 (D.D.C. 2018). To promote
predictability, finality, and preservation of judicial resources, the Court will revisit prior
1
To be sure, precisely when each plaintiff purchased identity-protection services, and what each knew beforehand, are factual questions at the heart of this case and will likely be hotly contested. See Reply Br. at 4. At the motion-to-dismiss stage, however, the Court was required to take the well-pleaded facts in the complaint as true and draw all reasonable inferences in Plaintiffs’ favor. Urquhart-Bradley v. Mobley, 964 F.3d 36, 40 n.2 (D.C. Cir. 2020).
3
interlocutory decisions only in “extraordinary circumstances,” such as “where the initial decision
was clearly erroneous and would work a manifest injustice” if left undisturbed. Kennedy v.
District of Columbia, 145 F. Supp. 3d 46, 49 (D.D.C. 2015) (Cooper, J.) (quoting Shea v.
Clinton, 850 F. Supp. 2d 153, 157–58 (D.D.C. 2012)). Relevant considerations include whether
the Court patently misunderstood the parties, strayed far beyond the issues presented,
misapprehended a material fact, or whether a significant change in controlling law had occurred
in the meantime. Id. No matter the basis, however, the moving party must always show “that
harm or injustice would result if reconsideration were denied.” U.S. ex rel. Westrick v. Second
Chance Body Armor, Inc., 893 F. Supp. 2d 258, 268 (D.D.C. 2012). So if fixing a supposed
mistake “would not impact the Court’s ultimate decision,” reconsideration is unwarranted.
White v. Hilton Hotels Ret. Plan, No. 16-cv-856 (CKK), 2019 WL 6877834, at *4 (D.D.C. Dec.
17, 2019). And reconsideration will be denied if a party merely recycles arguments already
rejected on the merits or raises new ones it could have made earlier. Fogg v. Bondi, No. 24-cv0792 (CRC), 2025 WL 2267811, at *2 (D.D.C. Aug. 8, 2025) (collecting cases).
Defendants argue that reconsideration of the order denying their motion to dismiss is
warranted because the Court misunderstood a relevant fact about the sequence of events.
Specifically, the Court’s motion-to-dismiss opinion reasoned that Plaintiffs’ decision to purchase
identity theft protection services was reasonable in light of, among many other things, a
whistleblower report concerning Russia-based users who allegedly used DOGE-related login
credentials to exfiltrate employee data from NLRB systems. See Nemeth-Greenleaf, 2026 WL
607905, at *2, *8. But as Defendants point out, that report did not become public until April
2025—two months after Plaintiffs filed their initial complaint. See FAC ¶ 49 n.23. Plaintiffs
therefore could not have relied on it when deciding to purchase identity-theft protection. And
4
without the whistleblower report, Defendants contend, Plaintiffs have not alleged enough to
show that their decision to purchase those services was reasonable based on what they knew at
the time. See Defs.’ Mot. at 3–7.
Defendants are correct about the chronology. The whistleblower report postdated the
initial complaint and thus could not have factored into Plaintiffs’ decision. See Initial Compl.
¶¶ 19–23 (alleging that Plaintiffs had purchased identity theft protection services by February 11,
2025). But subtracting the whistleblower report from the equation does not change the answer.
Based on the other allegations in the amended complaint—including reports from reputable
sources that predated the filing of the initial complaint—it was reasonable for Plaintiffs to take
prophylactic steps to protect their identity.
As the Court previously explained, Plaintiffs alleged that Defendants shared their
personal information with DOGE staffers who, at the relevant time, were not government
employees, had not completed the necessary training, and had demonstrated a willingness to
handle and share sensitive data in an insecure manner. See Nemeth-Greenleaf, 2026 WL
607905, at *8. Some of those staffers also had remarkably little work experience, and what
experience they did have was largely at Elon Musk’s private companies—circumstances that
reasonably raised questions about whether they could be entrusted with the security of highly
sensitive government data. Id. One staffer with allegedly “unfettered” access to PSI maintained
by OPM, for example, had graduated from high school in 2022, had previously worked at
Neuralink only as an intern, and went by the nickname of “Bigballs” on LinkedIn. FAC ¶¶ 33–
34. Experts described giving such nonemployees without proper training or clearances broad
access to sensitive data as “madness.” Id. ¶ 36 (quoting Charlie Warzel & Ian Bogost, The
Government’s Computing Experts Say They Are Terrified, THE ATLANTIC (Feb. 7, 2025)).
5
Plaintiffs also pleaded “that they were aware of contemporaneous public expert reports
about how changes in agency security protocols generally could lead to increased risk of
improper data exfiltration.” Nemeth-Greenleaf, 2026 WL 607905, at *8. Importantly, that
danger was not limited to improper handling by DOGE personnel themselves. Plaintiffs were
also allegedly aware of a meaningful risk of a further—and potentially more damaging—
disclosure to foreign adversaries. OPM, according to the complaint, is no stranger to foreign
cyberattacks. In 2015, for instance, hackers allegedly working on behalf of the Chinese
government carried out a large-scale attack on OPM, siphoning sensitive information belonging
to millions of federal workers. FAC ¶ 47. Against that backdrop, experts warned “that Russia,
China, Iran, and other adversaries could seek to exploit the chaos by launching new cyber
intrusions or targeting the devices and communications of Musk’s [DOGE] team.” Id. ¶ 48
(quoting Isaac Stanley-Becker et al., Musk’s DOGE Agents Access Sensitive Personnel Data,
Alarming Security Officials, WASH. POST (Feb. 6, 2025)). One expert put the concern more
vividly: “If I were a nation like China, Russia, or Iran, I’d be having a field day with a bunch of
college kids running around with sensitive federal government data on unencrypted hard drives.”
Id.
A federal employee who knew all that did not have to wait for an actual breach before
taking reasonable precautions to guard against potential fraud. Nothing about the timing of the
later whistleblower report undermines that conclusion. If anything, the whistleblower report
merely confirmed the risk that experts had already identified—foreign adversaries might exploit
weakened security practices to obtain sensitive employee data. See Nemeth-Greenleaf, 2026 WL
607905, at *9 (discussing how events post-dating the filing of the case demonstrate that
Plaintiffs’ “efforts to protect themselves have . . . proven only more reasonable as time has
6
passed”). The Court’s conclusion therefore remains unchanged: Plaintiffs have plausibly
alleged that purchasing identity theft protection services was a reasonable response to the risks
known to them at the time. With that established, Defendants’ arguments for reconsideration
have “already [been] rejected on the merits.” Fogg, 2025 WL 2267811, at *2 (quoting BEG
Invs., LLC v. Alberti, 85 F. Supp. 3d 54, 58 (D.D.C. 2015)). The Court will thus deny their
motion for reconsideration.
B. Motion to Strike Class Allegations
Defendants alternatively move to strike the complaint’s class allegations. That motion
has more force, as Defendants persuasively argue that Plaintiffs may encounter substantial
difficulty in satisfying the requirements for class certification. But that is a fight for another day.
Striking class allegations before class discovery begins is strong medicine, reserved for cases in
which the proposed class has a seemingly incurable legal infirmity. Defendants have not
identified one here. The Court therefore denies the motion to strike, without prejudice to
Defendants renewing their arguments later.
In this Court, defendants “may move at any time to strike . . . class action allegations.”
LCvR 23.1(b). But motions to strike “are a drastic remedy, which courts generally disfavor.”
Naegele v. Albers, 355 F. Supp. 2d 129, 142 (D.D.C. 2005). Pre-discovery motions to strike
class allegations are “even more disfavored.” Chen-Oster v. Goldman, Sachs & Co., 877 F.
Supp. 2d 113, 117 (S.D.N.Y. 2012) (citation omitted). That is so because “striking class
allegations is functionally equivalent to an order denying class certification,” Microsoft Corp. v.
Baker, 582 U.S. 23, 34 n.7 (2017) (cleaned up), and plaintiffs who state a potentially viable class
claim are almost always entitled to some class-related discovery before the question of class
certification is resolved, see Burton v. District of Columbia, 277 F.R.D. 224, 230 (D.D.C. 2011).
7
Accordingly, “courts rarely grant motions to . . . strike class allegations before there is a chance
for discovery” or a motion to certify has been filed. Smith v. Wash. Post Co., 962 F. Supp. 2d
79, 90 (D.D.C. 2013); In re McCormick & Co., Inc., 217 F. Supp. 3d 124, 140 (D.D.C. 2016)
(same); cf. Artis v. Yellen, 309 F.R.D. 69, 73 (D.D.C. 2015) (granting motion to strike “[a]fter
an exhaustive period of class discovery”).
But there is a narrow exception to that general rule: Courts may strike class allegations
before discovery when a legal defect is apparent from the face of the complaint and no factual
development could fix it. See Oliver v. Navy Fed. Credit Union, 167 F.4th 106, 110, 112–13
(4th Cir. 2026) (holding that class allegations may be struck at the pleading stage only if the
proposed class fails as a “matter of law”); Elson v. Black, 56 F.4th 1002, 1006 (5th Cir. 2023)
(explaining that courts may strike class allegations “before discovery is complete when it is
apparent from the complaint that a class action cannot be maintained”). Examples include where
the court lacks jurisdiction over class claims, see, e.g., Woodard v. FedEx Freight E., Inc., 250
F.R.D. 178, 182–83 (M.D. Pa. 2008), where the named plaintiff is necessarily atypical of the
proposed class, see, e.g., Abdul-Baaqiy v. Fed. Nat’l Mortg. Ass’n, 149 F. Supp. 3d 1, 10–11
(D.D.C. 2015), or when choice-of-law rules splinter a class and defeat predominance, see, e.g.,
Pilgrim v. Universal Health Card, LLC, 660 F.3d 943, 945–49 (6th Cir. 2011). In such cases
where the proposed class is doomed from the outset, striking class allegations is prudent to spare
the parties from unnecessary and burdensome class discovery. See Ross v. Lockheed Martin
Corp., No. 16-cv-2508 (KBJ), 2020 WL 4192566, at *2 (D.D.C. July 21, 2020).
In contrast, “[i]f the viability of a class depends on factual matters that must be developed
through discovery,” as is most often the case, “a motion to strike will be denied pending the fullblown certification motion.” 1 Joseph M. McLauglin, McLaughlin on Class Actions § 3:4 &
8
n.31 (22d ed. 2025) (collecting cases). So when the defendant’s objections depend on
indeterminate facts bearing on the Rule 23 factors—commonality, typicality, predominance,
ascertainability, or manageability—courts routinely and overwhelmingly deny pre-discovery
motions to strike class allegations and leave those fact-specific arguments for the classcertification stage. See, e.g., Mey v. Levin, No. 23-cv-46-JPB, 2023 WL 12089839, at *3
(N.D.W. Va. Sept. 15, 2023) (collecting cases); Winfield v. Citibank, N.A., 842 F. Supp. 2d 560,
573 (S.D.N.Y. 2012) (same). That remains true even when plaintiffs face long odds of
ultimately certifying the class. See, e.g., Painters & Allied Trades Dist. Council 82 Health Care
Fund v. Takeda Pharm. Co., 520 F. Supp. 3d 1258, 1273 (C.D. Cal. 2021) (“While there may
indeed be substantial hurdles to class certification in this case, the Court declines to strike the
class allegations at this juncture.”); Smith, 962 F. Supp. 2d at 91 (“Even if the Court is somewhat
skeptical that the facts will show that class resolution is appropriate in this case, it should not
prematurely decide the class certification issue.” (cleaned up)). In short, unless class
certification appears legally impossible from the face of the complaint, pre-discovery motions to
strike should be denied as premature.
The thrust of Defendants’ motion to strike is that Plaintiffs face a Sisyphean task in
satisfying Rule 23’s predominance requirement because individualized questions will overwhelm
any issues common to the class. See Defs.’ Mot. at 8–11. This argument is well taken. A class
cannot be certified if individual inquiries dwarf common ones. See Amchem Prods., Inc. v.
Windsor, 521 U.S. 591, 624 (1997)). And past cases have declined to certify Privacy Act
damages classes for this precise reason. See, e.g., Schmidt v. U.S. Dep’t of Veterans Affs., 218
F.R.D. 619, 637–38 (E.D. Wis. 2003); Lyon v. United States, 94 F.R.D. 69, 76 (W.D. Okla.
9
1982) (“In Privacy Act damages actions, questions affecting only individual members greatly
outweigh questions of law and fact common to the class.”).
Defendants emphasize a host of predominance-related obstacles that may derail
Plaintiffs’ path to certification. Three stand out. First, Plaintiffs want to certify a broad class.
See Defs.’ Mot. 10. But their proposed class of essentially “[a]ll current, former, and prospective
employees of the United States,” FAC ¶ 89, would likely “yield a high number of ‘false
positives’”—i.e., federal employees “who have spent no time on mitigation—and would thus
require ‘individualized proof of injury,’” Attias v. CareFirst, Inc., 344 F.R.D. 38, 53 (D.D.C.
2023) (Cooper, J.) (quoting In re Rail Freight Fuel Surcharge Antitrust Litig., 725 F.3d 244, 253
(D.C. Cir. 2013)). Second, it is far from obvious that any classwide source of proof exists “that
could readily show which potential class members undertook mitigation measures at all, and
specifically which potential class members acted in response to” the alleged Privacy Act
violations, “as opposed to any number of other data breaches in recent years” that may have
prompted a particular federal employee to purchase identity-protection services. Id. Third, even
if the class could be reliably circumscribed to employees who incurred out-of-pocket expenses to
protect themselves from the downstream effects of DOGE’s data handling, a plaintiff is entitled
to damages under the Privacy Act only if that prophylactic decision was reasonable. NemethGreenleaf, 2026 WL 607905, at *8. But as Defendants explain and the motion-to-dismiss
opinion demonstrates, gauging reasonableness entails a “highly fact-specific inquir[y] into what
each plaintiff knew, when they knew it, and what action they took in response.” Defs.’ Mot. at 9.
That said, the factual nature of Defendants’ arguments for striking the class allegations
underscore why the motion is premature. See Winfield, 842 F. Supp. 2d at 573 (“[A]
determination of whether the Rule 23 requirements are met is more properly deferred to the class
10
certification stage, where a more complete factual record can aid the court in making this
determination.”). Notably, Defendants almost exclusively cite opinions involving classcertification motions. See Defs.’ Mot. at 8–11. Because this is a pre-discovery motion to strike,
the standard for giving Defendants the relief they request is more stringent: Do the pleadings
show that class discovery would be futile due to insurmountable legal hurdles? Defendants’
arguments fall short of clearing that high bar.
For starters, this Court “is not bound by the class definition proposed in the complaint”
and should not strike the class allegations “simply because the complaint seeks to define the
class too broadly.” Robidoux v. Celani, 987 F.2d 931, 937 (2d Cir. 1993). Holding Plaintiffs to
the plain language of their pleadings-stage proposal “would ignore the ongoing refinement and
give-and-take inherent in class action litigation, particularly in the formation of a workable class
definition.” In re Monumental Life Ins. Co., 365 F.3d 408, 414 (5th Cir. 2004). Plaintiffs may,
after class discovery, propose a more narrowly defined class. See Ross, 2020 WL 4192566, at
*2 (explaining that class discovery allows “plaintiffs to flesh out the contours of their proposed
class action for certification purposes,” meaning that “the exact shape and form” of the class will
likely “evolve[]” (internal quotation marks and citation omitted)). This Court, too, retains
discretion to refine the class definition further—including by creating subclasses—should the
circumstances warrant. See Wagner v. Taylor, 836 F.2d 578, 589–90 (D.C. Cir. 1987).
Nor is it entirely “clear, at this point, that individualized proof of injury or damages will
[necessarily] overwhelm common issues.” Smith, 962 F. Supp. 2d at 91. After all, “the mere
fact that damage awards will ultimately require individualized fact determinations is insufficient
by itself to preclude class certification.” McCarthy v. Kleindienst, 741 F.2d 1406, 1415 (D.C.
Cir. 1984). Class discovery, moreover, will shed light on whether accurate “methods by which
11
to measure class-wide damages” exist. Joint Statement Regarding Class Disc. at 5. And any
difficulties in resolving the actual-damages element on a classwide basis might be avoided by
limiting certification to the violation element of Plaintiffs’ Privacy Act claims or to another
discrete issue susceptible to common resolution. See Harris v. Med. Transp. Mgmt., 77 F.4th
746, 760–61 (D.C. Cir. 2023) (“Rule 23(c)(4) may be used to certify an issue that is less than an
entire cause of action.”); Fed. R. Civ. P. 23(c)(4) (“When appropriate, an action may be brought
or maintained as a class action with respect to particular issues.”). Accordingly, although
“Plaintiffs will likely face an uphill battle at class certification,” the Court concludes that “it
would be premature to strike the class allegations before plaintiffs have had an opportunity to
develop the factual record and crystallize those common questions susceptible to common
answers.” Gilbert v. Lands End, Inc., No. 19-cv-1066-JDP, 2020 WL 1912003, at *5 (W.D.
Wis. Apr. 20, 2020).
Finally, Defendants seem to suggest that the class allegations should be struck because
Plaintiffs have proposed an impermissible “fail-safe” class—that is, a class defined in a circular
way that precludes membership unless the liability of the defendant is established. Defs.’ Mot. at
11. To illustrate, “a class defined as ‘those shareholders whom Company X defrauded’ would be
fail safe” because “[i]f the named plaintiffs prevail on the merits by showing fraud, then the class
is populated by all those with meritorious claims; if the named plaintiffs fail to prove fraud, there
will be no class members to be bound by the adverse judgment.” In re White, 64 F.4th 302, 303
(D.C. Cir. 2023). But the Court need not yet opine on whether the class proposed in the
complaint is “fail safe” because the remedy for a fail-safe class in this Circuit is not, as
12
Defendants suggest, to strike class allegations.2 Instead, the proper “solution . . . is for the
district court either to work with counsel to eliminate the problem or for the district court to
simply define the class itself” at the class-certification stage, after it has marched through Rule
23’s requirements. Id. at 311–15; see, e.g., Andres v. Town of Wheatfield, 621 F. Supp. 3d 415,
418–19 (W.D.N.Y 2022) (denying motion to strike class allegations based on purported fail-safe
class definition as premature). So whatever fail-safe concerns Defendants may have will be dealt
with once the class definition has matured at the certification stage.
III. Conclusion
For the foregoing reasons, it is hereby
ORDERED that Defendants’ [41] Motion for Reconsideration of the Order Denying
Their Motion to Dismiss is DENIED and their Alternative Motion to Strike the Class Allegations
is DENIED without prejudice.
ORDERED that the parties shall propose, by September 4, 2026, an updated joint
discovery plan in light of this opinion.
SO ORDERED.
CHRISTOPHER R. COOPER
United States District Judge
Date: August 28, 2026
2
To be sure, some courts have concluded that a proposed fail-safe class is one of the “rare few” instances where a pre-discovery motion to strike class allegations may be granted. Friel v. Line 5, LLC, No. 24-cv-1866-JKM, 2025 WL 2422617, at *4 (M.D. Pa. Aug. 21, 2025); see In re Google Generative AI Copyright Litig., No. 23-cv-03440-EKL, 2025 WL 1159998, at *3 (N.D. Cal. Apr. 21, 2025). But that is not the law in this Circuit.
13