Can a private company access information from your income tax return or provident fund records? The Supreme Court has asked the government to examine allegations that private verification entities are accessing, retrieving and commercially using sensitive employment and financial data, and to take steps to prevent any misuse.
The court was hearing a PIL alleging that a “commercial technological ecosystem” had emerged around the verification of personal information linked to EPFO/UAN records and -linked financial data. The court did not, however, find that any particular company had illegally accessed such records or hold that private firms can freely access citizens’ ITR or EPFO data.
The case has nevertheless raised an important question for millions of Indians. Can private companies access sensitive employment and financial information held by government agencies?
The Supreme Court expressed concern over the alleged misuse of sensitive personal information by private entities and asked the government to examine the issue.
According to reports of the hearing, the court said the government should consider devising an “antidote” to the problem with the help of domain experts. It directed the government and other authorities to consider the petitioner’s representations and take necessary action, preferably within four months.
But the court has not said that private companies can freely access everyone’s ITR or EPFO records. Nor has it found that a data breach took place. The court instead asked the authorities to examine allegations of unauthorised access, sharing, disclosure, transfer and commercial exploitation of sensitive data and decide what action, if any, is needed.
The PIL alleged that private verification entities were accessing or commercially exploiting statutory employment and financial data linked to EPFO/UAN records and PAN-linked information.
The petitioner pointed to private services allegedly offering or advertising access to information described as EPFO passbook data, Form 26AS data and income-tax-return information. The petition raised questions about how such information was being accessed, verified or processed and whether adequate consent and safeguards were in place.
The petitioner also alleged that private organisations could obtain such information for a fee and that attempts had been made to test some of these services. These are allegations made before the court and have not been established as facts by a judicial finding.
That is why the government’s examination will be crucial. It will have to determine whether such access is taking place, how any such access may be occurring and whether existing safeguards are sufficient.
An Return, or ITR, contains financial information filed by a taxpayer with the Income Tax Department. Other tax-related records, , can also contain sensitive information about a person’s income and financial transactions.
EPFO records relate to an . A Universal Account Number, or UAN, helps link an employee’s provident fund accounts across different jobs and can therefore be connected to parts of a person’s employment history.
The concern raised in the PIL is about information that citizens provide to government systems for specific statutory purposes potentially being accessed, verified or used by private entities in a separate commercial ecosystem.
Not on the basis of this Supreme Court order. The court has not said that simply knowing someone’s PAN or UAN gives a private company unrestricted access to that person’s ITR, provident fund records or complete employment history.
Different government databases have their own access and authentication mechanisms. The issue before the court was whether private verification entities may be accessing, retrieving or verifying some sensitive information through technological systems, intermediaries or other channels in a way that requires closer scrutiny.
The government’s examination may eventually clarify whether there are actual vulnerabilities, authorised interfaces being used in unintended ways, inadequate consent mechanisms or some other route through which such data can be accessed.
Background verification is a routine part of recruitment. Companies may want to check whether a job applicant worked with a previous employer or whether information provided during the hiring process is accurate.
Banks, insurers and other businesses may also have legitimate reasons to verify certain customer information.
The issue raised in this case is not whether all verification is wrong. The bigger question is how the verification is carried out and how much information a private entity should be able to access.
Checking whether a person previously worked for a company is different from obtaining sensitive records that were submitted to a government authority. The case has brought the focus on whether there is proper consent, a legal basis for access and adequate safeguards when government-held personal information enters private verification systems.
The government and other concerned authorities have been asked to consider the petitioner’s representations and take appropriate action, preferably within four months. The authorities concerned include those responsible for the employment and .
Their response could answer the questions the court itself has now brought into focus. Whether private entities are actually accessing sensitive EPFO and tax-linked data in the manner alleged, whether existing systems have gaps and what safeguards are needed to prevent misuse.
Until then, the Supreme Court order should not be read as proof that private companies are freely accessing everyone’s ITR or EPFO records. What it does establish is that the government has been formally asked to examine serious allegations about the possible commercial use of some of citizens’ most sensitive employment and financial information.