Supreme Court Asks Centre to Consider Safeguards Against Misuse of EPFO and ITR Data by Private Entities

The Supreme Court has asked the central government to consider devising safeguards to ensure that sensitive data from the Employees' Provident Fund Organisation (EPFO) and Income Tax Return (ITR) records is not misused by private entities.

During a hearing on Monday, a bench comprising Chief Justice Surya Kant and justices Joymalya Bagchi and V Mohana expressed concern over the emergence of a commercial technology ecosystem that allegedly accesses, retrieves, and verifies sensitive personal information contained in provident fund and income tax records.

The court was hearing a Public Interest Litigation (PIL) filed by petitioner Piyush Sharma, which raised concerns over private entities accessing and commercially exploiting individual data furnished to government authorities under statutory mandates. The petitioner stated that his personal inquiry revealed that providing Permanent Account Number (PAN) and Universal Account Number (UAN) details to a private verification workflow resulted in the retrieval of his complete employment history linked to those identifiers, without any OTP, explicit consent, or visible authorisation-based verification.

While the petitioner did not allege any leakage of data by government agencies, he highlighted the insecure status of individual information submitted to authorities under various laws. According to the petition, private employment verification ecosystems rely on data corresponding to statutory employment and financial records for purposes such as employment verification, moonlighting detection, dual employment screening, labour market profiling, and employment decision-making.

The bench observed that the issue essentially falls within the policy domain. However, it termed the private access to sovereign data, personal information submitted under the mandate of law, and the possibility of subsequent commercial exploitation as worrisome.

Refusing to entertain the PIL in its current form, the CJI suggested that the Centre devise an effective mechanism to address the issue with the assistance of domain experts. The bench ultimately asked the government to take necessary steps to prevent the misuse of individual data by private enterprises.

"The observations made by the Supreme Court highlight critical compliance and data governance considerations for businesses operating in India. As firms increasingly rely on background verification workflows, dual employment screening, and automated onboarding, founders and business leaders must proactively review their data sourcing practices. Ensuring absolute transparency, robust consent mechanisms, and strict alignment with statutory frameworks will be essential to mitigating regulatory risks as data protection norms and government oversight continue to evolve." — Dr. Shishir Gupta, Founder & CEO, StartupLanes