We spoke to Alison McDowell, Digital Identity Advisor at the Department for Culture, Media and Sport, Selina Brumant from the Home Office Right to Work Policy Team, and Keith Rosser, Chair of the Better Hiring Institute and Director of Reed Screening, to get the latest updates on the rollout and what it means for businesses and work seekers.
What is digital identity?
A digital identity is a digital representation of who you are and what you're eligible to do. It allows you to prove who you are during interactions and transactions without the need for physical documents. Digital identities would be created by trusted providers who, having carried out their own checks, could vouch for your identity to others, for example via credentials held on a smartphone.
A digital identity can be more convenient, cost effective, and safer than physical documents, and it can be used online or in person without the need to share physical identity documents like passports or proof of address.
It’s expected that digital identities will be something you'll use on a regular basis in future – they’re already used a lot in Sweden and the Nordics for day-to-day activities.
What changes are being made?
In December, the Home Office and DBS made a joint announcement that digital identity verification technology (IDVT) would be allowed for pre-employment, right to work and right to rent checks, replacing the current COVID-adjusted processes allowing for the remote verification of documents.
This means that employers will be able to rely on a digital identity to prove employees’ right to work in the UK, and to run DBS checks, rather than needing to verify documents themselves.
The legislation comes into force on the 6th April, and originally the COVID-adjusted checks were going to be rolled back at this time too. However, after receiving feedback that many employers wouldn’t be able to update their processes in time, the current COVID-adjusted checks can now be used until the 30th September, after which employers will need to use one of the new IDVT solutions or return to the physical checking of documents.
Digital document verification checks will need to be carried out through a third-party organisation – an Identity Service Provider or IDSP. For DBS, these will need to be certified through one of seven certification bodies authorised by UKAS.
In a change of policy since our last webinar, IDSP’s now no longer need to be certified to deliver digital identity verification for right to work checks – although it’s “strongly recommended” that employers choose a certified provider, and if an employer wants to outsource identity verification for both right to work and DBS checks, they’ll have to be certified for the DBS element.
IDSP’s are currently working with the newly-announced certifying organisations to gain certification and launch their offerings – Reed Screening is in the process of appointing a provider to manage our own digital identity verification service for DBS checks and right to work, and will be offering this as part of our screening packages or as a standalone check for right to work check.
It’s also important to note that IDVT is only available for people who hold an in-date British or Irish passport or Irish Passport Card – candidates who don’t hold one of these, or whose documents are out of date, will need to be checked manually, with documents shared either in person or sent via post. Employers need to be mindful, then, that candidates who aren’t able to participate in IDVT (or who don’t wish to – it’s optional for both employers and candidates) are not discriminated against during the application process.
Insights from our attendees
Our webinar was attended by over 230 organisations and we took the opportunity to gather their thoughts on digital identity in hiring:
What is the biggest challenge you see with digital right to work?
Fairness for applicants with out-of-date documents – 18%
Timescales – 14%
Understanding of the process – 51%
Cost – 15%
Does the extension to the 1st October give you enough time to implement digital right to work?
Yes - 48%
No, still not enough time – 8%
Not sure – 42%
Do you see digital identity as being fundamental to modern hiring?
Yes – 79%
No – 6%
Unsure – 13%
It’s clear that employers see the value in digital identity, but that understanding of the processes remains a big blocker – over half of our attendees felt this was the biggest blocker for implementing digital right to work in their organisations.
The extended deadline of September 30th seems to have been welcomed with cautious optimism – in February over two thirds of attendees at another of our webinars said that the earlier April 6th deadline was not achievable for them, and while this has now reduced to just 8%, over 40% of attendees still aren’t sure whether they’ll be able to make the deadline – likely because so much of the process for appointing IDSP’s remains unconfirmed.
It's likely that as the first IDSP’s gain certification, we’ll have a much clearer view of how the digital identity verification processes for right to work and DBS checks will work in practice.
Questions from our attendees
Unsurprisingly given the number who’d said they were unsure of the process, our webinar attendees had lots of questions for our presenters. We’ve summarised a few of the responses to the most popular questions here:
What will the ongoing process for certification of IDSP’s look like?
IDSP's are certified against a trust framework, which sets out the requirements and standards to be met. This is in alpha version at present, and we’ll be issuing new versions of this periodically - we’re doing beta testing this autumn, and we'll issue a new version before this and then continue to iterate over time. Bodies certified now will be checked in 12 months' time and required to recertify in 24 months' time against the currently enforced trust framework at that point in time.
If a check is carried out incorrectly, who is liable – the IDSP or the employer?
The employer retains the same risk they had in the past, and are responsible for ensuring checks are carried out to the required standard. However, they will form a contract with the IDSP and in those contracts they’d hold the IDSP accountable for operational error. We're passing legislation in DCMS which will mean that a digital identity can be as good as a physical one, so you can fully rely on digital checks against government-held data.
Can digital right to work checks be reused?
No. Liability remains with the employer so it'd be complicated to make this a portable check – if a business relied on a check that was made by a previous employer and this was done incorrectly, it'd lead to a very difficult situation. More generally, however, we’re anticipating digital identities becoming interoperable, so a candidate could have a single digital identity they could use for multiple reasons. It'll take time for this to happen as the market evolves, though.
Why move away from mandating the certification if IDSP’s for Digital Right to Work checks?
We had hoped to be able to mandate certification for right to work but legislation currently won't allow it, so for now we have to "strongly recommend" that employers use certified IDSP’s. If they want to use a single supplier for both DBS and right to work checks, that organisation will need to be certified to deliver the DBS element, so it’s likely that the vast majority of IDSP’s will be certified anyway.
How is digital identity not an identity card scheme by stealth?
Digital identity is not the same thing as a government identity card - this would require a central database of people’s information, and we’re not creating that. No new data is being created for IDVT, it's just the certification of existing documents - a record that documents were checked and found to be of the required standard. The government isn't issuing this identity or holding data in a central place, and you retain control of all your data.