Exactly how deep can a private company dig while running a background check? The Supreme Court has directed the government to investigate claims that these entities are commercially exploiting the sensitive income tax and provident fund records of millions of Indians. If proven true, it exposes a massive vulnerability in how government-held financial data is safeguarded.
While hearing a Public Interest Litigation (PIL) regarding a “commercial technological ecosystem” built around EPFO/UAN and PAN-linked data, the apex court mandated a formal government review, according to an India Today report.
The Supreme Court advised the government to collaborate with domain experts to devise an “antidote” to the problem and requested action preferably within four months.
The top court has not ruled that a data breach occurred, nor did it state that private firms can freely access citizens’ or EPFO records, the report noted. The directive is strictly an order for authorities to examine the claims of unauthorised access and commercial exploitation to determine what action is needed.
Core allegations
The unproven allegations in the PIL suggested that private services are advertising access to government-held data for a fee, raising serious questions about consent and data processing safeguards. The specific data in question includes:
- Tax Records: Income Tax Returns (ITR), , and Annual Information Statements, which hold sensitive details regarding a person’s income and financial transactions.
- Employment Records: data and Universal Account Numbers (UAN), which connect provident fund accounts across different jobs and map out an individual’s employment history.
Why do companies verify data?
Background checks are a routine part of recruitment, banking, and insurance, where businesses have a legitimate need to verify applicant or customer information.
- Core issue: The case does not suggest that all verification is wrong. However, checking a candidate’s past employment is fundamentally different from a private entity accessing sensitive statutory records submitted to a government authority.
- Current access: Simply knowing a PAN or UAN does not legally give a company unrestricted access to these records. The government’s examination will determine if there are system vulnerabilities or if authorised interfaces are being used in unintended ways.
What happens next?
Relevant authorities—including those responsible for managing employment and tax data—have been asked to review the petitioner’s representations. Their forthcoming response is expected to clarify whether private entities are actually accessing sensitive tax-linked and EPFO data in the manner alleged.
They must also clarify whether existing digital systems contain security or consent gaps, and what specific safeguards are required to prevent future misuse.
Until then, the India Today report said, the Supreme Court’s order should not be read as proof that private companies are freely accessing everyone’s data.
Instead, it establishes that the government has been formally tasked with investigating the potential commercial misuse of citizens’ most sensitive information.