There is often a concern in the minds of employed employees and taxpayers across the country whether a private company, bank or background verification agency can access their Income Tax Returns (ITR) and confidential records of the Employees Provident Fund Organization (EPFO) without their explicit consent. Recently this matter has reached the doorstep of the country's highest court i.e. the Supreme Court. The Supreme Court has expressed deep concern over the alleged misuse of sensitive employment and financial data of citizens and its commercial exploitation by private companies. The court has directed the Central Government and the concerned authorities to conduct a technical investigation into the matter and prepare protective measures i.e. 'antidote'. What petition was filed in the Supreme Court and what are the allegations? In a PIL filed in the Supreme Court (PIL – Piyush Chhabra vs Union of India), it was claimed that some private institutions doing background verification and financial investigation in the country have developed a technological ecosystem which is accessing the UAN, PAN, EPFO passbook and income tax records (Form 26AS, AIS) of the citizens. It was argued on behalf of the petitioner that: Some private agencies are openly advertising and claiming to get employment history, PF passbook details and tax return information of any employee in exchange for money. This data is allegedly being obtained without proper OTP or valid consent from the employees. Sensitive data entrusted by citizens to the government for statutory purposes (tax and PF) is being sold in the private market, which is a direct violation of the fundamental right to privacy under Article 21 of the Constitution. What did the Supreme Court say? Instructions to take action within 4 months The Supreme Court bench headed by the Chief Justice, accepting the seriousness of the matter, issued clear instructions to the Central Government and the concerned departments: No data leak or free decision: The Supreme Court made it clear that the court has not yet declared any specific company guilty of illegal data access nor has it accepted that any major data breach has taken place. Instructions to prepare antidote (solution): The apex court asked the government to do a technical investigation of this entire system with the help of cyber and domain experts and if there is any loophole in the security, then immediately fix it or prepare an antidote. Deadline set: The Supreme Court has asked the government to seriously consider the petitioner's memorandum and take necessary policy and legal steps within 4 months. Can a private company really view your ITR or EPFO data directly? As per government and technical regulations, the Income Tax portal of the Government of India and the EPFO database are highly secure and encrypted. Direct access not allowed: No private company can directly download your ITR form or PF passbook just by knowing your PAN card number or UAN number. Consent-Based API: When banks or authorized financial institutions process loans or credit cards, they take OTP-based explicit consent from the customer through an account aggregator or authentication framework. The main bone of contention: The main question before the court is whether some third-party verification companies are accessing this sensitive data in an unauthorized manner by creating a backdoor, by misusing the log-in credentials of intermediaries or recruiters. Data Protection Act (DPDP Act) and Employees' Rights Under the Digital Personal Data Protection Act (DPDP Act), it is illegal and a punishable offense to process, transfer or commercially sell the financial and personal data of any citizen without his/her valid, clear and purpose-based consent. After this intervention of the Supreme Court, now the Ministry of Electronics and IT (MeitY), Income Tax Department and EPFO will audit whether any unauthorized fetching is taking place on the APIs and verification portals of government databases. Only after the government's response in the next 4 months will it be completely clear how much more stringent this technical security framework will be made.
