As recruiters lobby government to change to some of the rules around the new digital right to work check system, Mark O’Hara examines how the UK’s right to work regime has changed and why it’s important for employers to choose a certified digital identity service provider.
On 1 October 2022, guidelines on how employers conduct right to work (RTW) checks in the UK changed. They were no longer able to use the Covid-adjusted checks over a video call that were introduced early in the pandemic. Instead, the new guidelines recommend employers carry out the necessary right to work check either via a digital identity service provider (IDSP), through a manual in-person check, or via the Home Office’s online share code service.
Businesses can now engage an identity service provider (IDSP) to complete the digital identity verification element of a right to work check for British and Irish citizens who hold in-date UK and Irish passports and Irish Passport Cards.
Although originally introduced as temporary Covid-19 measures, digital methods of conducting right to work checks proved to be beneficial to both the UK Digital Identity & Attributes Trust Framework (UKDIATF) and businesses. In today’s post-pandemic and increasingly digitised world, being able to carry out checks using an IDSP is a “must-have” capability for most employers, even for those recruiting only moderate numbers of new hires.
How to choose an IDSP for your business?
Digital identity service providers
The changes to right to work checks introduced on this date say that although using a government-certified digital identity service provider to carry out RTW checks is not mandatory, the Home Office “recommends” it.
The UKDIATF aims to increase trust in digital identities through the introduction of this certification standard for IDSPs. Certification against the framework is achieved after being thoroughly assessed against the Home Office requirements for providers’ technology, security and processes, meaning businesses and candidates gain peace of mind that they are using the best technology available.
One clear advantage of choosing a certified provider of digital right-to-work checks is that it ensures the necessary standards of safety and security when handling personal data are in place and digital right to work checks will be compliant with the framework. Less supplier due diligence is required, given some of the checklist requirements are already provided during the audit to gain certification.
There are a large number of digital identity service providers certified in line with the UK DIATF and there are strong reasons for employers to choose a certified IDSP.
No matter which IDSP a business chooses to work with, it is important they ensure the provider has all proper accreditations, including IS0 20071 and GDPR compliance.
GDPR compliance
Since the introduction of General Data Protection Regulation (GDPR) in 2018, individuals have been made more aware of how their personal data is handled by any business, even their employer. However, it can be time-consuming to be in line with GDRP best practice when checks are completed manually. There is also a considerable fine to pay should anything go wrong.
With a certified IDSP, they have met the clear standards for encryption and data management, offering peace of mind to employers and HR departments, taking one less responsibility off their shoulders.
Using a government-certified digital identity service provider with GPDR compliance embedded into the solution, means requirements are automatically met, and personal identity and address documents are processed compliantly.
Also using certified IDSPs proves a “statutory excuse” against civil penalties should a candidate be hired who does not have a right to work in the UK. Furthermore, the level of data protection and security shown by employers to candidates and employees when processing identity and address documents sets up a relationship of trust and respect.
Data security
Once a document has been submitted for verification, a trusted IDSP will carry out a series of biometric, document and database checks. Ensuring that a technology-first IDSP is being used to verify identity and address documents is key.
The alternative, where outsourcing to overseas teams occurs as part of identity verification, is a risky process called ‘data flight’. At this point, there is increased risk that data is not being processed correctly, and ultimately there is no security over who is exposed to it. There’s also a greater risk of misplacement, theft or loss of the data, let alone the opportunity for human error to create problems.
It is important to remember that even when using an IDSP for digital right to work checks, businesses will still need to verify the identity of an employee either in person on their first day, before they start, or via a video interview. This is so the IDSP result can be confirmed against the person employed.
The changes introduced to right to work guidelines on 1 October support the Home Office goal to establish trust in digital identities and come with a host of advantages, from enhancing candidate onboarding, to greater efficiency, better data security and improved accuracy of verification. However, in order to ensure firms are benefitting fully from the updates, they must consider carefully the IDSP they choose to work with and the additional benefits that a government-certified provider gives.
Recruitment and resourcing opportunities on Personnel Today
Browse more recruitment and resourcing jobs
Sign up to our weekly round-up of HR news and guidance
Receive the Personnel Today Direct e-newsletter every Wednesday
