Plea in Supreme Court flags sale of EPFO, ITR data for as little as Rs 100

Supreme Court Takes Note of Plea on Sale of Tax and Provident Fund Data

The Supreme Court on August 24 took note of a plea alleging that private organisations were advertising the sale of individuals' Income Tax Return (ITR) and Employees' Provident Fund Organisation (EPFO) data for as little as Rs 100. A three-judge Bench comprising Chief Justice of India Suryakant and Justices Joymalya Bagchi and V Mohana indicated that the government could be asked to consider the issue within a time-bound period.

The case, Piyush Chhabra v Union of India, was heard by the Bench. During the hearing, counsel submitted that representations had already been made to the authorities regarding private entities allegedly offering access to citizens' ITR and EPFO records. Counsel urged the Supreme Court to give the issue greater impetus by directing the government to consider the representations expeditiously.

The Bench indicated that, instead of immediately issuing notice, the concerned authorities could be directed to examine the detailed representation within a specified timeframe and place their response before the court. Counsel also told the Bench that an exercise had been undertaken by writing to private organisations, following which information relating to the counsel's friends was allegedly received. The exercise, counsel submitted, indicated that the matter was not merely an isolated occurrence and warranted examination by the authorities.

Court Expresses Concern Over Private Access to Sensitive Data

In a separate hearing of a PIL by Piyush Sharma, a bench of CJI Surya Kant and Justices Joymalya Bagchi and V Mohana expressed concern about a commercial technological ecosystem which allegedly accesses, retrieves and verifies sensitive individual information on provident fund and income tax returns. The court told the Centre about the desirability of devising an antidote to the problem with the assistance of domain experts.

The Bench noted the matter essentially fell within the policy domain but termed private access to sovereign data - individual information given to government under legislative mandate - and its commercial exploitation as worrisome. The petitioner said his personal inquiry into the issue had revealed that "upon merely furnishing PAN and UAN details to a private verification workflow, the petitioner received complete employment history corresponding the said identifiers. No OTP authentication was generated. No explicit consent was obtained. No visible authorisation-based identity verification process was undertaken."

Without blaming government agencies for any leakage of data, the petitioner highlighted the insecure status of individual data given to government under the mandate of different laws, as they are accessed at will by private entities. He further submitted that "Despite the statutory architecture governing EPFO and I-T data, there appears to be an emerging and concerning pattern wherein private employment verification ecosystems rely upon data corresponding to statutory employment and financial records for purposes such as employment verification, moonlighting detection, dual employment screening, labour market profiling and employment decision-making."

The Supreme Court agreed it was a serious matter but said it must be dealt with through a policy decision. On learning that the petitioner had sent two comprehensive representations to the Centre, the court asked the government to take necessary steps to prevent misuse of data by private enterprises.