look news india
There is often a concern in the minds of employed employees and taxpayers across the country whether a private company, bank or background verification agency can access their Income Tax Returns (ITR) and confidential records of the Employees Provident Fund Organization (EPFO) without their explicit consent. Recently this matter has reached the doorstep of the country’s highest court i.e. the Supreme Court.
The Supreme Court has expressed deep concern over the alleged misuse of sensitive employment and financial data of citizens and its commercial exploitation by private companies. The court has directed the Central Government and the concerned authorities to conduct a technical investigation into the matter and prepare protective measures i.e. ‘antidote’.
What petition was filed in the Supreme Court and what are the allegations?
A public interest litigation (PIL) filed in the Supreme Court – Piyush Chhabra vs Union of India) It was claimed that some private institutions doing background verification and financial investigation in the country have developed a technological ecosystem which is accessing the UAN, PAN, EPFO passbook and income tax records (Form 26AS, AIS) of the citizens.
It was argued on behalf of the petitioner that:
-
Some private agencies are openly advertising and claiming to extract employment history, PF passbook details and tax return information of any employee in exchange for money.
-
This data is allegedly being obtained without proper OTP or valid consent from the employees.
-
Sensitive data entrusted by citizens to the government for statutory purposes (tax and PF) is being sold in the private market, which is a direct violation of the fundamental right to privacy under Article 21 of the Constitution.
What did the Supreme Court say? Instructions to take action in 4 months
Recognizing the seriousness of the matter, the Supreme Court bench headed by the Chief Justice issued clear instructions to the Central Government and the concerned departments:
-
No decision on data leak or free will: The Supreme Court made it clear that the court has not yet declared any specific company guilty of illegal data access nor has it considered that any major data breach has taken place.
-
Instructions for preparing antidote (solution): The apex court asked the government to do a technical investigation of this entire system with the help of cyber and domain experts and if there is any loophole in the security, then it should immediately fix it or prepare an antidote.
-
Deadline set: The Supreme Court, while seriously considering the petitioner’s memorandum, directed the government to within 4 months Asked to take necessary policy and legal steps.
Can a private company really view your ITR or EPFO data directly?
As per government and technical regulations, the Income Tax portal of the Government of India and the EPFO database are highly secure and encrypted.
-
Direct access not allowed: No private company can directly download your ITR form or PF passbook just by knowing your PAN card number or UAN number.
-
Consent-Based API: When banks or authorized financial institutions process loans or credit cards, they take OTP based explicit consent from the customer through an account aggregator or authentication framework.
-
Main bone of contention: The main question before the Court is whether some third-party verification companies are accessing this sensitive data in an unauthorized manner by creating a backdoor, by misusing the log-in credentials of intermediaries or recruiters.
Data Protection Act (DPDP Act) and rights of employees
Under the Digital Personal Data Protection Act (DPDP Act), it is illegal and a punishable offense to process, transfer or commercially sell the financial and personal data of any citizen without his/her valid, clear and purpose-based consent.
After this intervention of the Supreme Court, now the Ministry of Electronics and IT (MeitY), Income Tax Department and EPFO will audit whether any unauthorized fetching is taking place on the APIs and verification portals of government databases. Only after the government’s response in the next 4 months will it be completely clear how much more stringent this technical security framework will be made.