The Supreme Court of India termed private commercial access to sovereign EPFO and ITR records "worrisome," directing the Centre to build safeguards against unauthorized employee data tracking. The ruling confirms that employers cannot freely access tax or provident fund records, mandating strict technical firewalls and consent mechanisms within four months.
NEW DELHI — The Supreme Court of India on Monday raised serious concerns over private background verification firms allegedly accessing citizens' sovereign financial and statutory employment records, directing the Union government to formulate stringent technical safeguards. Addressing a Public Interest Litigation (PIL) that examined whether an employer can see your ITR and Employees' Provident Fund Organisation (EPFO) details without authorization, a three-judge bench led by Chief Justice Surya Kant termed the commercial exploitation of sensitive taxpayer information "worrisome". The judicial intervention comes amid growing scrutiny over employee data privacy, automated moonlighting audits, and digital background verification practices across corporate India.
Judicial Scrutiny Over Background Verification Ecosystems
The legal proceedings originated from a petition filed by Piyush Sharma, which highlighted the proliferation of private business-to-business (B2B) application programming interfaces (APIs) and verification platforms. The petitioner demonstrated before the court that third-party background screening companies were offering corporate clients detailed employment histories, provident fund passbook records, Form 26AS data, and income tax filing records simply by feeding an individual’s Permanent Account Number (PAN) and Universal Account Number (UAN).
According to the petitioner's submissions, multiple commercial portals performed these automated retrievals without triggering One-Time Password (OTP) verifications, acquiring verifiable digital consent, or offering multi-factor authentication to the affected employee. The bench, which included Justices Joymalya Bagchi and V. Mohana alongside the Chief Justice, observed that while designing technical data architecture falls within executive policy, the state possesses a constitutional duty to prevent the misuse of mandatory sovereign data provided by citizens under statutory obligations.
Legal Privacy Protections for Income Tax Filings
Under Indian jurisprudence and statutory provisions, an individual's Income Tax Return is classified as confidential personal information. Section 138 of the Income-tax Act, 1961, strictly regulates the disclosure of taxpayer particulars, prohibiting public servants from sharing tax details with external private entities except under explicitly notified law-enforcement circumstances. Furthermore, the Supreme Court's landmark 2012 precedent in Girish Ramchandra Deshpande v. Central Information Commission established that personal financial details and tax returns submitted to public authorities are exempted from disclosure under Section 8(1)(j) of the Right to Information Act.
The current inquiry centers on whether third-party tech aggregators exploit unintended API loopholes, credential aggregation, or intermediaries to bypass these statutory barriers. In corporate human resources workflows, prospective or current employers increasingly utilize automated verification systems to detect resume discrepancies, undisclosed dual employment, or moonlighting. The apex court's observations make clear that commercial expediency cannot override statutory privacy rights or statutory data protection standards.
Impact on Employees, Corporates, and Background Verification Agencies
The Supreme Court’s directive has sent immediate ripples across India's human resources and background verification (BGV) industry. For millions of private and public sector employees, the ruling reinforces that an employer cannot see your ITR or personal provident fund passbook as an automatic corporate entitlement. Unless a candidate voluntarily provides physical copies of salary slips, Form 16, or tax acknowledgments as part of a transparent hiring evaluation, third-party electronic retrieval without explicit consent constitutes a major regulatory concern.
For corporate employers and risk-compliance firms, the judgment necessitates an urgent audit of vendor contracts. Verification firms must ensure that API integrations with public digital infrastructure comply with the Digital Personal Data Protection (DPDP) Act, maintaining robust audit trails, active consent records, and encrypted, purpose-limited data processing protocols.
Official Sources Section
Legal determinations, petitioner submissions, and judicial observations cited in this report are drawn from the official order records and open-court proceedings of the Supreme Court of India. Statutory compliance parameters and tax disclosure regulations are governed under circulars issued by the Income Tax Department of India, administrative mandates published by the [suspicious link removed], and data governance frameworks overseen by the Ministry of Electronics and Information Technology.
Judicial and Legal Statements
During the proceedings in New Delhi, the Supreme Court bench emphasized the necessity of structural state intervention to safeguard citizen records.
According to the bench comprising Chief Justice Surya Kant, Justice Joymalya Bagchi, and Justice V. Mohana:
"The access by private entities to sensitive data of EPFO and ITR records is worrisome. The Centre must devise an effective antidote and mechanism to address the issue with the assistance of domain experts and take necessary steps to prevent misuse of individual data by private enterprises".
The bench further directed the Union government to treat the representations submitted in the PIL as formal policy inputs and formulate appropriate administrative safeguards within four months.
Why It Matters
The question of whether an employer can see your ITR touches the core of modern workplace privacy and digital surveillance. By directing the central government to seal technological vulnerabilities around EPFO and tax portals, the Supreme Court ensures that statutory data collected for sovereign revenue and welfare purposes cannot be converted into an unmonitored commercial commodity. This ruling safeguards employee autonomy, prevents intrusive corporate surveillance, and establishes clear legal boundaries for the fast-growing digital verification industry.
Key Facts at a Glance
Apex Court Stance: The Supreme Court termed private commercial access to ITR and EPFO records "worrisome".
Policy Directive: The Centre has been directed to devise technical safeguards with domain experts, addressing the issue within four months.
Core Privacy Risk: The PIL exposed verification platforms retrieving full career and financial histories using only PAN and UAN identifiers without OTPs or explicit consent.
Statutory Protection: Tax returns remain protected personal information under the Income-tax Act and the Right to Information Act.
Frequently Asked Questions
Can your employer legally see your ITR without your consent?
No. Income Tax Returns are legally protected personal financial records under Indian law. Neither an employer nor a private background checking company has a statutory right to view or retrieve your ITR without your explicit authorization.
Why did the Supreme Court step in on ITR and EPFO data access?
The Supreme Court intervened after a PIL revealed that private background checking platforms were allegedly retrieving employee financial and employment histories using PAN and UAN data without multi-factor authentication or OTP consent.
Can background verification agencies retrieve your complete EPFO history?
While legitimate background verification requires an employee's explicit consent, the Supreme Court has directed the Union government to shut down unverified third-party API conduits that allow unauthorized access to provident fund data.
What should employees do if they suspect unauthorized financial background checks?
Employees can request data processing disclosures from their employer's human resources department, audit authorized verification consents, and report unauthorized access under the provisions of the Digital Personal Data Protection Act.
Source: Supreme Court of India, Income Tax Department, [suspicious link removed], Ministry of Electronics and Information Technology, Press Trust of India.
