The court was hearing a public interest litigation (PIL) alleging that a commercial ecosystem has emerged around the verification of personal information linked to EPFO/UAN records and PAN-linked financial data.
However, the Supreme Court has not found that any company illegally accessed such information. Nor has it ruled that private firms have unrestricted access to people’s ITR or EPFO records.
Instead, the case has raised a broader question with implications for millions of Indians: what personal information held by government agencies can private companies access, how are they accessing it, and has the individual consented to its use?
What did the Supreme Court say?
The Supreme Court expressed concern over the alleged misuse of sensitive personal information and asked the government to examine the issue.
A bench comprising Chief Justice Surya Kant and Justices Joymalya Bagchi and V Mohana said the government could consider finding an “antidote” to the problem with the help of domain experts. It directed the government and other authorities to consider representations made by the petitioner and take necessary action, preferably within four months.
The court, however, did not conclude that a data breach had taken place or that private companies can freely access ITR and EPFO records.
Instead, authorities have been asked to examine allegations involving unauthorised access, sharing, disclosure, transfer and commercial use of sensitive information and determine whether further action or safeguards are required.
What are the allegations?
The PIL alleged that private verification companies were accessing or commercially using employment and financial information linked to EPFO/UAN records and PAN-linked tax data.
The petitioner pointed to private services allegedly advertising products such as “EPFO Passbook API”, “Form 26AS API” and “Income Tax Return API”, raising questions about how such information was being obtained or verified.
According to reports of the proceedings, the petitioner also claimed that an experiment involving PAN and UAN details returned an individual’s employment history without OTP authentication, explicit consent or a visible identity-verification process. These claims were placed before the court and have not been established through a judicial finding.
The government’s examination could now help determine whether such access is actually taking place, how it is happening and whether existing protections are adequate.
What kind of information is involved?
An Income Tax Return (ITR) contains financial information submitted by a taxpayer to the Income Tax Department. Tax records can contain details relating to a person’s income, taxes and financial transactions.
EPFO records, meanwhile, contain information related to an employee’s provident fund account. A Universal Account Number (UAN) links an employee’s provident fund accounts across different jobs and can therefore be connected to parts of a person’s employment history.
The concern raised in the PIL is essentially about information that people provide to government systems for specific purposes potentially being accessed or used by private companies for other purposes.
So, can private companies access your ITR or EPFO data?
The Supreme Court order does not establish that they can.
The court has not said that simply knowing someone’s PAN or UAN gives a private company unrestricted access to that person’s income tax returns, provident fund records or complete employment history.
Government databases have their own access and authentication systems. The issue before the court is whether private verification companies may be obtaining or verifying some sensitive information through technology platforms, intermediaries or other channels in ways that require closer scrutiny.
The government’s review could establish whether there are loopholes in existing systems, whether legitimate access mechanisms are being used in unintended ways, whether consent mechanisms are adequate or whether information is being obtained through other routes.
Why would private companies want this information?
Background checks are common during recruitment. An employer may, for instance, want to confirm whether a candidate actually worked at a company listed on their resume.
Banks, insurers and other businesses may also have legitimate reasons to verify specific information provided by customers.
The issue raised by the case is therefore not whether verification itself is improper. The question is how that verification happens and how much personal information a private company should be allowed to access.
Confirming whether someone previously worked for a particular employer is different from obtaining detailed employment or financial records that the person provided to a government authority.
The case has therefore put the focus on whether people have properly consented to their information being used, whether private companies have a legitimate basis for accessing it and whether sufficient safeguards exist to prevent misuse.
What happens next?
The government and other concerned authorities have been asked to consider the petitioner’s representations and take appropriate action, preferably within four months.
Their examination could answer three important questions: Are private companies accessing sensitive tax and EPFO-linked information as alleged? If so, how are they getting it? And are the safeguards protecting that information strong enough?
Until then, the Supreme Court proceedings should not be interpreted as proof that private companies have unrestricted access to people’s ITR or EPFO records.
For now, the court has asked the government to examine the allegations and take steps to prevent the misuse of sensitive personal information by private entities.
