Employers using digital right-to-work checks will be able to verify British and Irish workers using passports that expired up to six months earlier under new government rules published this week. The government published updated standards for digital right-to-work verification on 1 September. The revised code replaces one issued in June that never came into force.
Allowing recently expired passports
Under the new code, a digital identity can be created using a British passport, Irish passport or Irish passport card. For the first time in this version, the document may have expired, provided that happened no more than six months before the check. Additional safeguards apply when an expired document is used. The digital verification service must confirm that the passport’s cryptographic security features are genuine and the document must not have been visibly clipped.
Related: Millions of holiday days go unused annually
The identity check must reach at least a medium level of confidence under the government’s Good Practice Guide 45. This change brings digital checks into line with Home Office regulations allowing expired passports for this purpose. However, the six-month restriction in the supplementary code means employers should not assume any expired British or Irish passport will be accepted. British and Irish citizens cannot use the Home Office share-code service to demonstrate their right to work. Employers can instead check original documents or use an identity service provider offering Identity Document Validation Technology.
What providers must supply to employers
The new code sets out the information a digital verification service must give an employer following a successful check. This includes the worker’s given name, surname and date of birth. The service must also provide an image of the passport or passport card and a photograph of the person whose identity has been verified. The service must identify itself and provide the date of the identity check.
Employers must additionally receive confirmation that the provider has a registered service and that the check was conducted in accordance with the supplementary code. A link to the service’s entry on the government’s digital verification services register must also be supplied. The information must be provided in a clear and legible format that cannot be altered. Responsibility for retaining the required evidence remains with the employer rather than the digital verification service.
Related: 468 Rule Hong Kong Effective Date and Key Changes to Know
The Office for Digital Identities and Attributes oversees the UK’s digital identity framework. It says employers’ obligations continue to be determined by Home Office regulations and guidance. The government currently says employers are not required to use a provider certified against both the digital verification services trust framework and the supplementary right-to-work code. It has, however, warned that this will become mandatory in the near future and recommends that employers entering long-term contracts use certified services. Using a digital service does not transfer the employer’s right-to-work obligations to that provider. Failure to carry out the required checks can leave an employer without a statutory excuse against a civil penalty if it is subsequently found to have employed someone illegally.
Stored digital identities and portable checks
The new code introduces rules for what the government calls “holder services”. These allow an existing digital identity to be stored and used for particular purposes. A digital verification service can use a pre-existing identity to conduct a new right-to-work check. It must establish that the person still holds an eligible British or Irish passport or passport card. The document must not have been cancelled, withdrawn, visibly clipped or expired by more than six months.
Related: Nearly Half of Workers Work Sick, Productivity Drops
This does not make right-to-work checks portable between employers. The code specifically states that checks cannot simply be transferred from one employer to another. Holder services can instead be used in circumstances where an employer or another organisation needs to establish whether the individual carrying out work is the person whose right to work has already been successfully checked. The service must know that the original check was successful and remains valid and must establish whether the holder-service user and the worker who underwent that check are the same person. Additional identity security standards apply to these services.
Despite being published on 1 September, the new code did not automatically take effect on that date. It comes into force when the first conformity assessment body is accredited to certify services against this version.
