DEV Community

Serguey Shinder
Serguey Shinder

Posted on

Our Right to Work Checks Are Going Digital and Our Onboarding Still Expects a Photocopy

Everyone who works at one of our depots, whether employed by us or supplied by an agency, has to show they have the right to work in the UK before their first shift. For most of our history that meant a passport or another document, checked by a supervisor, photocopied and filed. We take on around nine hundred people a year, and in peak season the checks happen at six in the morning in a depot office.

That process has quietly built one of the more sensitive collections we hold. When we counted last month, there were scanned copies of about six thousand passports and identity documents, in the HR document system, on two shared drives and attached to emails, including several hundred belonging to agency workers who stayed for a fortnight in 2021.

This is going to change whether we plan for it or not. Employers can already use certified identity providers to check British and Irish passports digitally. The government has said that a digital ID will be required for right to work checks before the end of this parliament. Instead of handing over a document, a new starter will share a verified credential from a phone, and what we receive will be an answer confirmed by someone else, not a picture of a page.

I think this is good news, and most of our systems are not ready for it. Our onboarding workflow has a mandatory upload field for a document scan and will not move forward without a file. The HR record uses the passport number as the person's identifier until they have a National Insurance number. Our service desk confirms who a caller is by asking for details that came from those same scans.

So we have started. The upload field is becoming optional. We have asked HR which decisions genuinely need the document itself, and so far the answer is very few. The service desk is moving to checks that do not depend on anything printed on a passport. And the six thousand copies have a deletion plan, because the rules require evidence of the check for two years after someone leaves, not a scan kept forever.

For years our systems have proved who someone is by keeping a copy of the proof. The next ten years will favour the ones that can accept an answer and keep nothing else.

– Serguey Shinder

Top comments (0)