The Supreme Court of India has called on the Union government to formulate safeguards preventing private companies from accessing and commercially exploiting individuals’ sensitive financial and employment records stored with public authorities.
A three-judge bench comprising Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice V Mohana on Monday described third-party access to sovereign database records as worrisome. While declining to entertain a public interest litigation seeking direct intervention, the court advised the Centre to work alongside domain experts to establish an effective framework against data misuse.
Policy Domain And Judicial Stance
The bench observed that regulating data verification protocols lies within the executive’s policy domain. Although the court chose not to pass formal orders on the petition, it underscored the necessity of protecting personal information submitted to government bodies under statutory mandates from being commercialized without proper authorization.
Commercial Use Of Statutory Records
The petition, submitted by Piyush Sharma, highlighted the emergence of a commercial technology ecosystem that leverages Employees’ Provident Fund Organisation (EPFO) and Income Tax Return (ITR) data. According to the plea, private background-verification entities utilize statutory employment and financial records for commercial purposes, including background checks, moonlighting detection, dual employment screening, and labor market profiling.
Lapses In Consent Mechanisms
To demonstrate the vulnerability of personal records, Sharma stated that entering a Permanent Account Number (PAN) and Universal Account Number (UAN) into a private verification system yielded his complete employment history. The petitioner pointed out that the process retrieved sensitive personal records without generating a one-time password (OTP), obtaining explicit user consent, or executing visible identity verification.
The petitioner clarified that the plea did not allege data leaks originating directly from government agencies. Instead, it focused on the lack of adequate safeguards preventing private firms from harvesting statutory information submitted under legal requirements. Taking note of these submissions, the court urged the government to implement necessary measures to prevent private enterprises from misusing individual data.
