[Misc] GDPR Question

[Murray 17]

Does anybody know if a company is allowed to keep your identification documents? I am considering joining an agency, and they tell me they would keep copies of my passport for when they are audited. On the other hand, 2 other companies tell me they just keep a record of what they have seen. Who is correct?

Sent from my SM-G950F using Tapatalk

 

[Barham's tash]

My understanding was that it’s all consent based and not strictly black and white. In your example Company A has decided it wants to keep copies for audit purposes and if you consent then it’s fine. Company B has decided for its audit policy its good enough to simply have a record of what was seen.

 

[super-seagulls]

Does anybody know if a company is allowed to keep your identification documents? I am considering joining an agency, and they tell me they would keep copies of my passport for when they are audited. On the other hand, 2 other companies tell me they just keep a record of what they have seen. Who is correct?

Sent from my SM-G950F using Tapatalk

If you are looking to join them to work, they need to keep copies of your ID and Nat ins.
Is a record of what they have seen not a copy!

As far as I am aware an employer should have proof that you are who you say you are.

 

[super-seagulls]

Also this isn’t really GDPR, unless they do not store the info securely or if they flog it to the highest bidder!
Holding your personal info does not break GDPR law.

 

[Beach Hut]

Also this isn’t really GDPR, unless they do not store the info securely or if they flog it to the highest bidder!
Holding your personal info does not break GDPR law.

Exactly my understanding GDPR is all about safe storage of personal data, not what data you actually hold.

 

[dazzer6666]

They absolutely need to see valid (original) ID documents (HO requirement re right to live/work in UK etc), but don't necessarily need to retain a copy as long as they keep details. As already stated you should be asked to consent to them holding copies if that's what they do. Any employer will also need the same, but if the agency already have it they might rely on those (depends on the employer's policy, contract with the agency etc)

 

[Skuller]

I hate to disagree with people but I think GDPR does have a lot to say about this situation. GDPR is about safe storage but an awful lot more besides. Firstly, they must say in a data privacy policy what they'll do with this information. They have to have a good reason to keep it and a policy to remove it when that good reason ends, and the data has to be accurate. The subject of the data also has a right to be "forgotten" and have the data removed. The subject also has the right to ask the company to reveal all the personal data the company holds.

My advice is to ask for the data privacy policy which covers this type of information. You have the right to go to the Information Commissioner if you don't think they need to retain this data, or if it's gone out-of-date (inaccurate data), and exactly what they plan to do with it.

 

[super-seagulls]

Why not just let them copy your ID?
Why would you have a problem with your employer doing that?

 

[Super Steve Earle]

Honestly, why do you care? I don't get why people get so het up about their records (unless they have something to hide).

 

[Brian Fantana]

I hate to disagree with people but I think GDPR does have a lot to say about this situation. GDPR is about safe storage but an awful lot more besides. Firstly, they must say in a data privacy policy what they'll do with this information. They have to have a good reason to keep it and a policy to remove it when that good reason ends, and the data has to be accurate. The subject of the data also has a right to be "forgotten" and have the data removed. The subject also has the right to ask the company to reveal all the personal data the company holds.

My advice is to ask for the data privacy policy which covers this type of information. You have the right to go to the Information Commissioner if you don't think they need to retain this data, or if it's gone out-of-date (inaccurate data), and exactly what they plan to do with it.

I’d agree with this. It’s all about the intended use of the data, and whether there’s a valid business reason for doing so. In the case of the OP, I’d say it’s a reasonable requirement during the job application process/probationary period for this information to be stored. Once that period has ended, there’s more of a question to ask around the reasons for doing so (depending on the industry/nature of work, there may be further valid reasons for storage).

 

[super-seagulls]

Honestly, why do you care? I don't get why people get so het up about their records (unless they have something to hide).

Are you copying me?
I don’t get why people do that!

 

[Brian Fantana]

Honestly, why do you care? I don't get why people get so het up about their records (unless they have something to hide).

The simple reason is that personal data stored badly can easily lead to it falling into the wrong hands, and identity theft taking place. There have been so many examples of large companies having their data security breached and millions of customer records stolen (including very personal and actionable data).

 

[beorhthelm]

they can keep copies of your details. i'd be more suspect about the other two companies denying they'll keep copies, could end up in trouble with Home Office. GDPR covers how they protect and process that data. solicitors to car dealers to banks keep copies of passports, its fine as long as they keep them safe and dont use them for anything other than stated purpose.

 

[clockend1983]

Why not just let them copy your ID?
Why would you have a problem with your employer doing that?

Yeah that’s what I was thinking
Seems a lot of agro worrying about stuff like that

 

[Skuller]

they can keep copies of your details. i'd be more suspect about the other two companies denying they'll keep copies, could end up in trouble with Home Office. GDPR covers how they protect and process that data. solicitors to car dealers to banks keep copies of passports, its fine as long as they keep them safe and dont use them for anything other than stated purpose.

... and they must have a good, stated reason to keep it (under GDPR). If they've used it to check ID, then I see no reason why they should keep the originals. If they're arguing that it'll save time next time you apply through them, then it's a specious argument under GDPR, and would not be allowed.

 

[Super Steve Earle]

The simple reason is that personal data stored badly can easily lead to it falling into the wrong hands, and identity theft taking place. There have been so many examples of large companies having their data security breached and millions of customer records stolen (including very personal and actionable data).

There are so many ways in which any individual can suffer from a data breach however cautious they are. It's a fact of modern life and won't go away. Being careful and aware is sensible, but being precious about one's personal data and refusing to disclose for legitimate reasons can just make your own life more difficult.

 

[LadySeagull]

I hate to disagree with people but I think GDPR does have a lot to say about this situation. GDPR is about safe storage but an awful lot more besides. Firstly, they must say in a data privacy policy what they'll do with this information. They have to have a good reason to keep it and a policy to remove it when that good reason ends, and the data has to be accurate. The subject of the data also has a right to be "forgotten" and have the data removed. The subject also has the right to ask the company to reveal all the personal data the company holds.

My advice is to ask for the data privacy policy which covers this type of information. You have the right to go to the Information Commissioner if you don't think they need to retain this data, or if it's gone out-of-date (inaccurate data), and exactly what they plan to do with it.

This ^^^

It seems excessive to keep the actual passport image and I would object and exercise your right to be forgotten and tell them to 'erase' the image. It is important that firms do not excessively retain data that they do not need.

The other companies' policies are correct IMHO. This company's policy is excessive and unnecessary, which is in breach of the DPA 2018.

 

[beorhthelm]

... and they must have a good, stated reason to keep it (under GDPR). If they've used it to check ID, then I see no reason why they should keep the originals. If they're arguing that it'll save time next time you apply through them, then it's a specious argument under GDPR, and would not be allowed.

obvious reason would be for immigration checks, to show you have seen the employees ID. if you no longer work there, they should remove after sensible period. but that wasnt the question.

 

[Official Old Man]

As an employer, only 5 staff and generally overseas students part time, I always insist on firstly seeing a passport plus having a photo copy which I then store with signed contract and other details, like a P45 or similar, in my office. These are things an employer must have in case of a check by immigration.
But what about going on holiday overseas? You arrive at a hotel and check in and the first thing that happens is you hand over your passport and the guy disappears out the back with it.

 

[SeagullinExile]

It's probably for right to work in the UK purposes. I scan a copy of all my teams I.D's.