Can employers keep a copy of your passport without hiring you?

[Applefruitcake]

I'm just wondering if this is common practice? Obviously, if an employer is going to hire you they need proof that you can legally work in the UK, but if the potential employer does actually intend to hire you, do they have the right to take a copy of your passport? I have been to a few interviews recently where they have done this. In the first instance, I assumed it was because they were planning on hiring me, but apparently this is common practice. In not sure if I feel comfortable with a company holding copies of my legal documents.

YABU - This is common practice
YANBU - They shouldn't keep your documents before starting the employment process

Yes. If you're unsuccessful then it will be destroyed.

We are told to keep copies for a certain amount of time (in case they challenge the decision I think, so we can demonstrate that we did everything correctly)

There are regulations around how long they can keep copies before destroying them.

Yes, they're kept for a certain amount of time incase an application is challenged. I think auditors need to see them too to check due diligence.

I have a feeling the employer / agency should make you aware of this before the interview, but I could be wrong - don't quote me

I disagree. Under the new GDPR they should only keep a copy of personal data for a limited number of reasons.
Lawful processing of data
Contract
Legal obligation
Vital interest
Public interest
Legitimate interest.

Keeping applications might be ok under legal obligation (eg to ensure equality of process), but am not sure if the justification for keeping passport copy. Tbh I'm not sure they could justify taking a copy at interview at all.
Seeing a copy to confirm right to work, then taking a copy once appointed yes, but other than that I'd argue no.

Not a lawyer, but aware that there isn't much case law yet so could be open to interpretation.

If you are unsuccessful the photocopy of your right to work in the UK document will be destroyed

They're supposed to destroy it, but you never really know, do you? So many companies don't stick to the rules. If a recruiter picks up your CV on a jobs website, has a brief phone chat, asks you to send your passport scan over and then of course you never hear from them again because the job never existed or the client changed their mind. I do feel uncomfortable about it.

@Catlover77

If you are unsuccessful the photocopy of your right to work in the UK document will be destroyed

Whilst it should be destroyed you can't say iit will be, there will always be employers who don't abide by the rules. I think it's a valid concern and one I was thinking about just the other day.

YANBU. In my organisation we have been told to only ask for and take copies of right to work documents from the successful candidate. And only when they have formally accepted the offer. Gathering this information from all candidates is a breach of GDPR.

O. They can only hold it sufficient time and with your consent for it to be used for intended purpose. It should be destroyed once you’ve been rejected. In fact, ideally it should only be collected if offered employment.
It shouldn’t even really be held on file if you are appointed.
The reason for seeing it is to confirm identity and to ensure legal right to be employed in U.K. Once that’s been ascertained there is no further need of it. It should be destroyed and your records should just show checks have been made.

Due to the need to see the original copy it is common practice to ask you to bring it to assessment.

I used to work somewhere where we took passport copies at interview to speed up the process when an applicant was offered and accepted. We used to shred/delete the copies as soon as the successful applicant had accepted.

Yabu but it should be on condition that it is destroyed within a specified time should you be unsuccessful, according to their gdpr and privacy policy. I've also submitted - and taken - documents to be copied for DBS at the interview stage as it saves an extra trip and delay.

You will have most likely consented to their keeping of your data by ticking a box called GDPR consent

Write to them and asked to be removed from
Their database

@CherryPavlova

O. They can only hold it sufficient time and with your consent for it to be used for intended purpose. It should be destroyed once you’ve been rejected. In fact, ideally it should only be collected if offered employment. It shouldn’t even really be held on file if you are appointed. The reason for seeing it is to confirm identity and to ensure legal right to be employed in U.K. Once that’s been ascertained there is no further need of it. It should be destroyed and your records should just show checks have been made.

What if company was later audited? I think copy should be retained

I think they may retain it as proof of checking for successful candidates.

What if company was later audited? I think copy should be retained

The trail of rejection and acknowledgement of that would be enough for audit unless the reason for rejection was directly related to identity or residency and that had been identified in the rejection.

@Unescorted

What if company was later audited? I think copy should be retained

The trail of rejection and acknowledgement of that would be enough for audit unless the reason for rejection was directly related to identity or residency and that had been identified in the rejection.

It think this comment was related to keeping it for successful applicants - in which case it is legitimate to hold such data for employees to prove their right to work.

They can only hold personal data for a legitimate business purpose - so if they haven't offered a person the role they shouldn't ask or retain personal information about people who have not been offered the role. The business reason would be to ascertain if the person was able to take up the position offered . They should not ask for or retain the information on the off chance they will offer the role.

It is legitimate and necessary to keep a copy on successful candidates personnel files.

You will have most likely consented to their keeping of your data by ticking a box called GDPR consent

I do not agree that an employer can obtain consent at all for a prospective employee, the balance of power is such that it cannot be meaningfully given.

If you're going to take a copy, legitimate interest will be the grounds, and certainly ascertaining etw before offer is probably reasonable, I'm pretty sure it's never been tested but I can't see much of a problem with it.

in which case it is legitimate to hold such data for employees to prove their right to work

It's a legal obligation, it's also a legal obligation to destroy which many companies fail as they take copies via scan to email, or email around etc. and then don't delete the emails, or scanner back ups. But they're all minor technical infringements really.

Thank you for all of your replies. This seems to be more common of a practice than I thought.

Just to clarify as I realised I made a mistake in my original post, I am specifically referring to situations where a copy of a passport is taken during the interview process before / without a job offer being made.

Also, I am referring to a photocopy of the passport being made and then retained by the employer, not just seeing the passport.

In response to the 'saving time' reasoning, surely successful candidates will need to come back at some point anyway to sign the employment contract and have an induction etc. You could argue that it takes more time to leave the room during an interview to photocopy passports for every single candidate rather than just a few successful ones.

Seems dodgy to me. My employer needed to see my updated DBS certificate. I wasn't allowed to email over a copy, as then it would be on the system, breaching GDPR. I had to have a video call and let them see it over Zoom instead. (Pre-covid would have been in person) I would also feel uncomfortable leaving a trail of passport copies everywhere I applied to work.

You can submit a contract by post or even sign acceptance online and most inductions take place, in normal times, on first day of employment and may not be with hr.