Supreme Court Raises Alarm Over Private Access to Sensitive Government Data

NEW DELHI: In a significant development concerning digital privacy and data security, the Supreme Court of India on Monday expressed serious concern regarding the commercial exploitation of sensitive personal information. The bench, led by Chief Justice of India Sanjiv Khanna and Justices Joymalya Bagchi and V. Mohana, flagged the existence of a private technological ecosystem capable of accessing and verifying sensitive data related to Income Tax returns and Provident Fund (PF) records.

The apex court has directed the Union Government to formulate a robust strategy to curb the unauthorized use of such sovereign data, suggesting that the Centre should engage domain experts to develop an “antidote” to this burgeoning issue.

The Security Gap

The court was hearing a Public Interest Litigation (PIL) filed by petitioner Piyush Sharma, who highlighted a glaring loophole in how government-mandated data is handled. Sharma’s petition demonstrated that by simply providing a Permanent Account Number (PAN) or a Universal Account Number (UAN) to certain private verification platforms, one could retrieve an individual’s entire employment history.

Crucially, the petitioner noted that this process occurred without any One-Time Password (OTP) authentication, lacked explicit user consent, and bypassed any standard authorization-based identity verification.

“Despite the statutory architecture governing EPFO and I-T data, there appears to be an emerging and concerning pattern wherein private employment verification ecosystems rely upon data corresponding to statutory employment and financial records,” the petition stated. These platforms reportedly utilize this sensitive data for purposes ranging from background checks and “moonlighting” detection to complex labor market profiling.

A Call for Policy Intervention

While the Supreme Court acknowledged that the matter primarily falls under the policy domain, it characterized the private commercialization of data—provided by citizens to the government under legislative mandate—as highly “worrisome.”

The bench clarified that it was not accusing government agencies of deliberate data leaks. Instead, the focus remains on the “insecure status” of personal information that is currently being accessed at will by private entities.

The petitioner informed the court that he had previously submitted two comprehensive representations to the Union Government regarding these vulnerabilities. In light of this, the Supreme Court directed the Centre to review these concerns and take all necessary steps to prevent the potential misuse of sensitive individual data by private enterprises.

This directive marks a critical step in the ongoing discourse regarding data privacy in India, emphasizing the state’s responsibility to protect the digital footprints of its citizens against unauthorized commercial exploitation.