Concerns over the privacy of financial and employment records have reached the Supreme Court after allegations emerged that private verification firms may be accessing sensitive information linked to EPFO, UAN, PAN and income-tax records.
The Supreme Court has asked the Union government to examine the issue and consider measures to prevent possible misuse of such personal data. The matter arose from a public interest litigation alleging that a commercial technology ecosystem may have developed around retrieving, verifying and commercially using information that individuals provide to government agencies under statutory requirements.
The case is particularly important because provident fund records, employment history and income-tax information can reveal substantial details about a person's financial and professional life.
However, the court has not ruled that any particular private company illegally accessed such information, nor has it held that private firms are generally entitled to freely access citizens' ITR or EPFO records. The proceedings instead focus on allegations of unauthorised access and whether stronger safeguards are required.
What Did the PIL Allege?
The petition raised concerns about an allegedly unregulated system in which private verification companies may be able to access or process information linked to employees' provident fund and tax records.
According to reports on the proceedings, the petitioner referred to data associated with EPFO and UAN records, PAN-linked financial information, Income Tax Returns, Form 26AS and Annual Information Statements (AIS). The plea sought action against unauthorised access, disclosure, sharing, transfer or commercial exploitation of such information.
The concern is significant because these databases can contain information relating to employment history, tax deductions, financial transactions and other records that individuals may reasonably expect to remain protected.
Supreme Court Calls the Issue Worrisome
A bench comprising Chief Justice of India Surya Kant, Justice Joymalya Bagchi and Justice V Mohana heard the matter.
During the proceedings, the court expressed concern about the possibility of private entities gaining access to sensitive information collected by government authorities. It indicated that commercial exploitation of such data would raise serious questions and suggested that the government examine ways to address the issue, including taking assistance from domain experts.
The Supreme Court ultimately directed the Union government and other concerned authorities to consider the petitioner's representations and take appropriate action to prevent misuse of data collected by the EPFO and Income Tax Department. The court indicated that a comprehensive decision should preferably be taken within four months.
Can a Private Company Simply Access Your ITR or EPFO Records?
The court proceedings should not be interpreted as establishing that private businesses have unrestricted access to such government-held information.
In fact, one of the central questions raised by the litigation is precisely how private entities may be obtaining or verifying this information and whether the process involves proper authorisation and consent.
The Supreme Court has not made a finding that every service claiming to verify employment or financial information is illegally accessing government databases.
Instead, the government has been asked to investigate the allegations and examine whether regulatory or technological safeguards are needed.
This distinction is important because verification businesses may obtain information through different mechanisms, some of which could involve information voluntarily provided by users or authorised interfaces.
For example, the Income Tax Department itself provides certain APIs for authorised e-Return Intermediaries. Its published documentation states that taxpayer consent is required in specified processes, such as adding a taxpayer as a client.
The existence of authorised APIs, therefore, should not automatically be confused with allegations of unauthorised access.
'EPFO Passbook API' and 'ITR API' Services Under Scrutiny
The petitioner reportedly pointed to advertisements for private services using descriptions such as “EPFO Passbook API,” “Form 26AS API” and “Income Tax Return API.”
According to the petition, the advertising of such products raises questions about whether companies are capable of retrieving, processing or verifying sensitive statutory data and, if so, what permissions allow them to do it.
One allegation placed before the court was that some private verification workflows could generate employment-history information after PAN and UAN details were supplied, allegedly without an OTP or explicit consent from the individual concerned. These remain allegations presented in the litigation rather than findings of wrongdoing against a specific company.
Why EPFO and Income-Tax Data Is Sensitive
An individual's EPFO or UAN-linked information may reveal aspects of employment history, while tax-related records can contain detailed financial information.
Form 26AS, for example, contains information relating to tax deducted or collected at source. The Income Tax Department's Annual Information Statement can contain additional information including specified financial transactions, tax payments, refunds and other financial details.
When several such data points are combined, they can create a detailed profile of an individual's employment and finances.
That is why questions surrounding consent, legitimate purpose, data security and unauthorised commercial use have become central to the dispute.
Three Major Questions the Case Raises
The proceedings bring three broad privacy issues into focus.
First, what information held by government departments can legitimately be accessed or verified by private businesses?
Second, what technical or legal mechanism should govern such access?
Third, when personal information is used for employment verification or another commercial purpose, has the individual clearly authorised that use?
These questions could have implications beyond EPFO and income-tax records because digital verification services are increasingly used by employers, financial institutions and online platforms.
What the Supreme Court Has Not Said
For taxpayers and employees, it is important not to misread the court's observations.
The Supreme Court has not declared that private companies are freely permitted to access ITR, EPFO or UAN records.
It has also not concluded at this stage that a named private company has unlawfully extracted government data.
Instead, the court has recognised that the allegations raise serious privacy concerns and has asked the government to examine them and consider safeguards against misuse.
What Should Individuals Do With Their PAN and UAN Details?
Until there is greater clarity, individuals should be careful when sharing identifiers such as PAN and UAN with unfamiliar websites, apps or verification services.
Before providing such information, users should understand why it is being requested, who will process it and whether they are authorising access to additional employment or financial records.
Sensitive identifiers should not be shared merely because a website claims to offer instant employment, tax or financial verification.
The Supreme Court proceedings may eventually lead to clearer safeguards governing how private verification companies can handle government-linked personal information. For now, the key takeaway is that the allegations are under government scrutiny and that the court has emphasised the need to prevent misuse of citizens' sensitive financial and employment data.
