The Supreme Court has expressed serious concern over the alleged access of private companies to sensitive personal information held in government records and its possible commercial use. The court has asked the Centre to take necessary steps to prevent the misuse of individual data by private enterprises.
A bench comprising Chief Justice of India Surya Kant and Justices Joymalya Bagchi and V. Mohana was hearing a public interest litigation on Monday. The bench observed that the matter essentially falls within the policy domain, but termed private access to sovereign data and its commercial exploitation a matter of concern.
Claim of access to PF and income tax data
Petitioner Piyush Sharma told the court that his personal inquiry into the issue had raised serious questions about the security of government-held data. According to his submission, merely providing PAN and UAN details to a private verification workflow enabled him to obtain the complete employment history associated with those identifiers.
The petitioner claimed that no OTP-based authentication was generated during the process. He also alleged that no explicit consent was obtained and that there was no visible authorisation-based identity verification mechanism.
The petition did not directly accuse government agencies of leaking the information. Instead, it raised concerns about the apparent ease with which personal information submitted to the government under various statutory requirements could allegedly be accessed by private entities.
Algoritha Security Launches ‘Make in India’ Cyber Lab for Educational Institutions
Questions over use of statutory records for employment checks
According to the petitioner, private employment verification platforms are increasingly relying on information linked to statutory employment and financial records. Such information is allegedly being used for purposes including employment verification, detection of moonlighting or dual employment, labour market profiling and employment-related decision-making.
The petitioner highlighted the potential privacy and data security risks arising from such practices and questioned whether adequate safeguards exist before sensitive government-linked information is accessed or processed by private entities.
Supreme Court flags private access to sovereign data
The Supreme Court noted that personal information submitted by citizens to the government under a legal mandate is fundamentally different from ordinary commercial data. Such information may include details relating to employment, income and financial activity, placing a responsibility on the government to ensure that it is adequately protected.
The bench indicated that a clear policy framework may be required to regulate private access to such information and prevent its unauthorised or inappropriate commercial exploitation.
The court also indicated that domain experts could assist in developing an effective mechanism to address the emerging concerns surrounding the use of government-held personal data.
Centre asked to take necessary steps
During the hearing, the court was informed that the petitioner had already submitted two detailed representations to the Centre outlining the concerns.
After taking note of the representations, the Supreme Court asked the government to take necessary steps to prevent the misuse of individual data by private enterprises.
The court, however, did not attribute any alleged data leakage to a particular government agency at this stage. Its concern was focused on the broader issue of private access to information that citizens are required to provide to the government under various laws.
Growing pressure for stronger data safeguards
The issue assumes significance as digital platforms increasingly process employment, financial and identity-related information. Government-linked records such as provident fund and income tax data can contain highly sensitive details about an individual’s employment history, income and financial activities.
The possibility of such information being accessed without adequate authentication or clear consent raises significant questions about privacy, data security and accountability.
The Supreme Court’s intervention highlights the need for stronger safeguards governing the use of government-held personal information by private entities. The Centre will now have to consider appropriate policy and regulatory measures, with the court making it clear that preventing misuse of sensitive individual data requires a structured response backed by necessary expertise and safeguards.
