Prevent misuse of data by private entities, SC tells government | India News

SC flags private access to sensitive PF, I-T data, asks Centre to prevent misuse by firms

NEW DELHI: Supreme Court Monday expressed concern about a commercial technological ecosystem which allegedly accesses, retrieves and verifies sensitive individual information on provident fund and income tax returns and told the Centre about the desirability of devising an antidote to the problem with the assistance of domain experts.Hearing a PIL by Piyush Sharma, a bench of CJI Surya Kant and Justices Joymalya Bagchi and V Mohana noted the matter essentially fell within policy domain but termed private access to sovereign data – individual information given to govt under legislative mandate – and its commercial exploitation as worrisome.Petitioner said his personal inquiry into the issue had revealed that “upon merely furnishing PAN and UAN details to a private verification workflow, the petitioner received complete employment history corresponding the said identifiers. No OTP authentication was generated. No explicit consent was obtained. No visible authorisation-based identity verification process was undertaken”.Without blaming govt agencies for any leakage of data, the petitioner highlighted the insecure status of individual data given to govt under the mandate of different laws, as they are accessed at will by private entities.

“Despite the statutory architecture governing EPFO and I-T data, there appears to be an emerging and concerning pattern wherein private employment verification ecosystems rely upon data corresponding to statutory employment and financial records for purposes such as employment verification, moonlighting detection, dual employment screening, labour market profiling and employment decision-making,” he said.SC agreed it was a serious matter but said it must be dealt with through a policy decision. On learning the petitioner sent two comprehensive representations on the issues to Centre, it asked govt to take “necessary steps to prevent misuse of individual data by private enterprises.”