Archive · 25 Aug 2026
Supreme Court Orders Probe Into Alleged ITR, EPFO Data Misuse
The Supreme Court is looking into claims about how private companies may check people's tax and employment information.
The information could include income tax records and provident fund details.
A petition claimed that some businesses might be selling or using this information.
The court has not decided that these claims are true.
It also has not said that companies can freely see everyone's records.
The government must investigate how the information may be accessed and whether people gave permission.
Ordinary background checks, such as confirming a person's previous job, can be legitimate.
But viewing detailed government-held financial or employment records is a more serious matter.
The government has been asked to consider safeguards and take action, preferably within four months.
The Supreme Court has asked the government to examine allegations involving private firms and PAN- and EPFO-linked data.
The allegations include possible commercial use of ITR, Form 26AS, Annual Information Statements, EPFO passbooks and UAN records.
The court has not found that a data breach occurred or that companies have unrestricted access to these records.
The government and relevant authorities were asked to consider the petitioner's representations and act preferably within four months.
The review will examine access methods, consent safeguards, possible system vulnerabilities and whether further protections are needed.
- Who
- The Supreme Court, the government, relevant data authorities and private verification firms mentioned in the petition.
- What
- The court directed the government to examine allegations that private entities may be accessing, sharing or commercially using sensitive ITR- and EPFO-linked information.
- When
- The authorities were asked to act preferably within four months; the articles do not specify the hearing date.
- Where
- The matter was heard by the Supreme Court of India.
- Why
- The review was ordered because the petition raised concerns about unauthorised access, consent, data security and the commercial use of government-held personal information.
Petitioner's Privacy Concerns
Court's Limited Finding
Alleged access and commercial use
Petitioner's Privacy Concerns
The petition alleges that private verification companies may be obtaining, sharing or commercially using sensitive tax and employment information, including through advertised data services.
Court's Limited Finding
The court has not determined that any company illegally accessed the information or that a data breach occurred.
Background checks
Petitioner's Privacy Concerns
The petition raises concerns that detailed statutory records may be accessed for purposes beyond those for which people provided them to government systems.
Court's Limited Finding
The articles note that verifying specific information, such as whether a candidate worked for a particular employer, can be a legitimate business activity.
Consent and safeguards
Petitioner's Privacy Concerns
Claims before the court included access to employment history without OTP authentication, explicit consent or visible identity verification; these claims remain unproven.
Court's Limited Finding
The government review will determine whether legitimate access mechanisms, technology platforms or intermediaries are being used improperly and whether stronger safeguards are needed.
- Data mentioned
- Income Tax Returns, Form 26AS, Annual Information Statements, EPFO passbooks and UAN-linked employment information.
- Alleged services
- The petition referred to services advertised as “EPFO Passbook API,” “Form 26AS API” and “Income Tax Return API.”
- Court's finding
- The Supreme Court has not established that a breach occurred or that private firms have unrestricted access to the records.
- Investigation deadline
- The government and other authorities were asked to consider the representations and act preferably within four months.
- Key questions
- Authorities will examine whether access is occurring, how it happens and whether existing safeguards and consent mechanisms are adequate.
- Legitimate verification
- Recruiters, banks and insurers may have legitimate reasons to verify specific information, such as prior employment.
