Identity fraud,

Who is allowed to process what identity information?

Nowadays, people are constantly reminded that identity information should not be shared without consideration. Unfortunately, this still happens (too) often. For example, when a copy of a passport is requested for certain transactions, people often don’t question the necessity of this request. However, not every organisation may ask for such identity information. If the identity can be established in another, less intrusive way, this should always be the preferred choice.

Sometimes you may be asked for proof of identity. For example, when picking up a package. In this case, showing identity proof e.g. a valid passport or driving license is sufficient and no copy may be made . Asking for a complete copy of the identity document is only permitted when there is a legal obligation to do so because such a copy contains all the important personal data. Organisations with a legal obligation include governments, financial institutions, notaries, life insurers, and employers. However, they do have a duty to inform, which means that they must indicate what data they use and for what purpose.

Some organisations have a legal obligation to make a copy of particular data from an identity document. In this case, a complete copy is not necessary, and noting the type of identity document and its number is sufficient. Organisations that are allowed to ask for limited identity data are, for example, healthcare providers, educational institutions, and hotels.

The Dutch ‘Compulsory Identification Act’ for (new) employees

The Dutch ‘Compulsory Identification Act’ states that everyone in the Netherlands aged fourteen and older must be able to identify themselves with a valid identity document when requested to do so by the competent authorities. This obligation to identify also applies to national and international employees in the workplace. This Dutch ‘Compulsory Identification Act’ consists of three parts:

• Verification obligation: Even before the employment contract is signed, the identity of the new employee must be established. For example, by requesting and verifying an identity document.
• Retention obligation: The copy of this identity document must then be included in a company’s personnel records, where it will be kept for at least five years after the employee leaves the company.
• Care obligation: Employees must be able to identify themselves in the event of an inspection. This means that they must always carry a valid identity document in the workplace.

Please note, that the duty of verification and duty of care also apply when employing temporary staff, such as personnel that are supplied by an employment agency.

As an organisation, it is important to know who you are hiring and retaining. An identity check, for example, where a scan or photo of the identity document is requested and verified for authenticity is often the first step.

Verification obligation, an important part of the Dutch ‘Compulsory Identification Act’

To be able to guarantee quality and integrity as an organisation, you need to know who you are hiring. It is therefore a good thing that the verification obligation applies even before a new employee starts their work. This verification obligation consists of two parts:

• Checking the identification document: Each document has specific and authentic characteristics that can be verified.
• Checking the new employee: This involves checking whether the identity document matches the employee. For example, a passport photo can be assessed for similarities, but also the specified physical characteristics such as height and age. Subsequently, the nationality and signature can be checked.

Preventing identity fraud with Validata’s smart software

For recruitment and HR departments, requesting, checking, and correctly storing an identity document can be a time-consuming process. Valuable time, which they can better use to focus on their core business. So it is only logical that the identity check is the most frequently performed check within the screening profiles offered by Validata.

Several legal requirements apply to the processing of identity data. For example, the General Data Protection Regulation (GDPR) and the GDPR Implementation Act determine how this data should be handled. By screening with Validata you ensure that your organisation always complies with the most current (privacy) laws and regulations.

During an identity check a (potential) employee is asked to upload a scan or photo of the identity document within a secure online account. To minimise the number of steps, this can be done directly within Validata’s online environment where once the scan or photo is uploaded it will directly appear in the online account.

More about the identity check