NEW DELHI: The Supreme Court has said the access by private entities to sensitive data of EPFO and ITR records was “worrisome”, and asked the Centre to consider devising safeguards to ensure that such information is not misused.
A bench comprising Chief Justice Surya Kant and justices Joymalya Bagchi and V Mohana, on Monday, expressed concern over the emergence of a commercial technology ecosystem allegedly accessing, retrieving and verifying sensitive personal information contained in provident fund and income tax records.
The CJI, while refusing to entertain a PIL filed by Piyush Sharma on the issue, suggested that the Centre devise an effective mechanism to address the issue with the assistance of domain experts.
The PIL raised concerns over private entities accessing and commercially exploiting individual data furnished to government authorities under statutory mandates.
The bench said the issue essentially falls within the policy domain, but termed as “worrisome” the private access to sovereign data, personal information submitted by individuals to government authorities under the mandate of law, and the possibility of subsequent commercial exploitation.
During the hearing, the petitioner said his personal inquiry had revealed that merely furnishing Permanent Account Number (PAN) and Universal Account Number (UAN) details to a private verification workflow resulted in the retrieval of his complete employment history linked to those identifiers.
According to the PIL petitioner, the process did not involve generation of an OTP, obtaining of explicit consent or any visible authorisation-based identity verification.
The petitioner, however, did not allege any leakage of data by government agencies.
Instead, he highlighted the insecure status of individual information submitted to government authorities under various laws, claiming that such data could subsequently be accessed by private entities without adequate safeguards.
“Despite the statutory architecture governing EPFO and I-T data, there appears to be an emerging and concerning pattern wherein private employment verification ecosystems rely upon data corresponding to statutory employment and financial records for purposes such as employment verification, moonlighting detection, dual employment screening, labour market profiling and employment decision-making,” the petitioner said.
Taking note of the submissions, the bench asked the government to take “necessary steps to prevent misuse of individual data by private enterprises”.
