The Supreme Court has flagged private access to EPFO and income tax data as 'worrisome' and asked the Centre to consider safeguards against misuse of personal information. According to Upstox News Desk, a bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana expressed concern over the emergence of a commercial technology ecosystem allegedly accessing, retrieving and verifying sensitive personal information contained in provident fund and income-tax records. The apex court mandated a formal government review while advising the government to collaborate with domain experts to devise an 'antidote' to the problem. The court emphasized that it has not ruled that a data breach occurred, nor stated that private firms can freely access citizens' ITR or EPFO records. The directive is strictly an order for authorities to examine the claims of unauthorised access and commercial exploitation to determine what action is needed.
The unproven allegations in the PIL suggested that private services are advertising access to government-held data for a fee, raising serious questions about consent and data processing safeguards. As reported by Upstox News Desk, the petitioner revealed that merely furnishing Permanent Account Number (PAN) and Universal Account Number (UAN) details to a private verification workflow resulted in the retrieval of complete employment history linked to those identifiers. The petitioner highlighted that the process did not involve generation of an OTP, obtaining of explicit consent or any visible authorisation-based identity verification. The specific data in question includes Tax Records such as Income Tax Returns (ITR), Form 26AS, and Annual Information Statements, which hold sensitive details regarding a person's income and financial transactions. Additionally, the allegations cover Employment Records including EPFO passbook data and Universal Account Numbers (UAN), which connect provident fund accounts across different jobs and map out an individual's employment history.
Taking note of the submissions, the bench asked the government to take 'necessary steps to prevent misuse of individual data by private enterprises'. According to Upstox News Desk, relevant authorities—including those responsible for managing employment and tax data—have been asked to review the petitioner's representations. Their forthcoming response is expected to clarify whether private entities are actually accessing sensitive tax-linked and EPFO data in the manner alleged. The court noted that personal information submitted by citizens to the government under a legal mandate is fundamentally different from ordinary commercial data, placing a responsibility on the government to ensure adequate protection. The Supreme Court indicated that a clear policy framework may be required to regulate private access to such information and prevent its unauthorised or inappropriate commercial exploitation. The Chief Justice suggested that the Centre devise an effective mechanism to address the issue with the assistance of domain experts.
The petitioner highlighted 'an emerging and concerning pattern wherein private employment verification ecosystems rely upon data corresponding to statutory employment and financial records' for purposes such as employment verification, moonlighting detection, dual employment screening, labour market profiling and employment decision-making. As reported by Upstox News Desk, despite the statutory architecture governing EPFO and I-T data, there appears to be an emerging pattern where private entities are using such data for commercial purposes. The petitioner did not allege any leakage of data by government agencies but instead highlighted the insecure status of individual information submitted to government authorities under various laws, claiming such data could subsequently be accessed by private entities without adequate safeguards. The court emphasized the need for adequate safeguards to prevent misuse of sensitive personal data by private enterprises.
