DBS and right to work

[LifeIsTooFlippingShort]

I work in a school which does a recheck of DBS every 5 years via MAT HR, who use a 3rd party external software. I always produce my docs for checking and recording of numbers and have never had a problem in 30 years. The last time however I was forced against my objections to take colour scans of my birth cert, driving licence and passport and email them to a group distribution email at the MAT. This is so that they can store these docs on another separate 3rd party software. When I investigated why this happens now, it turns out that they only have one DBS policy; the one they use for new starters. I understand that this is why existing employees have this 'right to work' checked whenever their DBS re-check occurs. Is this legal? They aren't checking all employees at the same time, just the odd one who is due a DBS recheck. I've already had all my id doc numbers stolen via the DBS 3rd party software. I really don't want these colour scans to be stolen from the other application MAT HR use if it's hacked! MAT HR are being very unhelpful and refusing to delete these scans.

A right to work check is required before an employee starts work. The employer is required to keep a clear copy of each document checked. They therefore need copies of your passport and birth certificate, either physical or electronic. I am therefore not surprised they are refusing to delete the scans. They are legally required to keep them.

I understand they need to do this for new employees, but I've worked there for 30 years! My understanding is that for existing employees recruited prior to 2022 the employer either has to 'right to work' check all of the workforce or none. They can't check random long term employees. They are very casual with our data and I already live in fear of my name being used to take out loans fraudulently due to the hack on their DBS software where my name, address, DL number, DOB and passport number were stolen. It's made me feel extremely vulnerable.

They do not have to do right to work checks on employees from the EU, EEA or Switzerland if they came to the UK before 1st July 2021. However, there is no law preventing them from doing so. If they don't currently have all the records they should, getting the required information at the same time as carrying out DBS checks could be an efficient way of doing so. It does, however, expose them to the risk that they could be fined for not having the correct documentation for those employees who have not yet undergone a fresh DBS check.

If they are not holding this information as part of right to work checks, that would be a different situation. I suggest you ask them for the lawful basis under GDPR on which they are holding this information.

@prh47bridge thank you! I will.

I should add that I'm a uk citizen born in Essex 60 odd years ago!