Supreme Court Worried About EPFO, I-T Data Access by Private Firms
By ThePip Desk
India’s Supreme Court expresses grave concern over private entities accessing sensitive EPFO and income-tax data, urging the government to implement safeguards against misuse.
The Supreme Court has labeled private entities’ access to sensitive data from the Employees’ Provident Fund Organisation (EPFO) and income-tax records as “worrisome.” The court has formally urged the Central government to implement robust safeguards, aiming to prevent the potential misuse of this personal information.
A bench, including Chief Justice Surya Kant, highlighted the growth of a commercial technology ecosystem that reportedly accesses, retrieves, and verifies sensitive personal data. This process involves information from both provident fund and income-tax records.
Concerns Over Data Exploitation
While declining a Public Interest Litigation (PIL) filed by Piyush Sharma, the Chief Justice recommended the Centre develop an effective mechanism with domain experts. The PIL specifically raised alarms about private entities commercially exploiting individual data submitted to government authorities under statutory mandates.
The petitioner’s personal investigation revealed a significant vulnerability. Providing Permanent Account Number (PAN) and Universal Account Number (UAN) details to a private verification workflow allowed the retrieval of a complete employment history without several critical security measures:
- Requiring an OTP
- Explicit consent from the individual
- Authorization-based identity verification
The petitioner clarified that the concern was not data leakage by government agencies. Instead, it focused on the insecure status of individual information, which private entities could access without adequate safeguards.
Court’s Directive for Data Protection
The Supreme Court acknowledged that while the issue falls within the policy domain, the private access to sovereign data and its potential for commercial exploitation remains deeply “worrisome.”
Based on these submissions, the court instructed the government to take “necessary steps to prevent misuse of individual data by private enterprises.” This directive underscores the urgency for robust mechanisms to protect citizen data.