Personal data request - is this normal / legal? Personal data request - is this normal / legal?
Page 1 of 2 12 LastLast
Posts 1 to 10 of 13
  1. #1

    Nervous Newbie

    contractUKonline has no reputation


    Join Date
    Nov 2016
    Posts
    12

    Post Personal data request - is this normal / legal?

    Hey all,

    I’ve just landed a new contract - as part of the recruitment company’s vetting process they are asking for copies of my passport, address and NI number. This is on top of all the company documentation.

    I have two issues:
    1) is this legally required? I am technically employed by my company, this is who the contract is between the recruiter and the limited company - is there any need for my personal documents? Also I don’t understand at all why they need my NI number...

    2) they’ve just requested it over email - they don’t have an encryption process etc and when I’ve asked grandular questions about my data (where is it held, how long etc) they can’t answer.

    What would everyone do? Just send it? Query it more? Push back because it’s not needed?

  2. #2

    I live on CUK

    Old Greg is always on top

    Old Greg's Avatar
    Join Date
    Mar 2007
    Location
    The Tombliboo Bush
    Posts
    27,158

    Default

    Quote Originally Posted by contractUKonline View Post
    Hey all,

    I’ve just landed a new contract - as part of the recruitment company’s vetting process they are asking for copies of my passport, address and NI number. This is on top of all the company documentation.

    I have two issues:
    1) is this legally required? I am technically employed by my company, this is who the contract is between the recruiter and the limited company - is there any need for my personal documents? Also I don’t understand at all why they need my NI number...

    2) they’ve just requested it over email - they don’t have an encryption process etc and when I’ve asked grandular questions about my data (where is it held, how long etc) they can’t answer.

    What would everyone do? Just send it? Query it more? Push back because it’s not needed?
    Normal enough. They want to check you are entitled to work in the UK so they don't get in hot water.
    Quote Originally Posted by Bean
    I admit that I'm a lazy lying cretin, but so what?
    25 June 2018

  3. #3

    Godlike

    Zigenare is a fount of knowledge

    Zigenare's Avatar
    Join Date
    Apr 2018
    Posts
    6,114

    Default

    Quote Originally Posted by contractUKonline View Post
    Hey all,

    I’ve just landed a new contract - as part of the recruitment company’s vetting process they are asking for copies of my passport, address and NI number. This is on top of all the company documentation.

    I have two issues:
    1) is this legally required? I am technically employed by my company, this is who the contract is between the recruiter and the limited company - is there any need for my personal documents? Also I don’t understand at all why they need my NI number...

    2) they’ve just requested it over email - they don’t have an encryption process etc and when I’ve asked grandular questions about my data (where is it held, how long etc) they can’t answer.

    What would everyone do? Just send it? Query it more? Push back because it’s not needed?
    Name the agency, we'll let you know if we've had any bad experiences with the same organisation.
    Old Greg - In search of acceptance since Mar 2007. Hoping each leap will be his last.

  4. #4

    Godlike

    Lance - scorchio!

    Lance's Avatar
    Join Date
    Sep 2013
    Location
    home
    Posts
    5,287

    Default

    You are correct that your company is the one with the legal obligation to validate that you are entitled to work in the UK. Assuming you are outside IR35 (i.e. not an employee of the client or agency).

    However, the client could end up in hot water if they are found to have a load of illegals working on their site so they insist on extra checks as part of their due dilligence.

    If you're concerned about email then send the passport by registered post.
    See You Next Tuesday

  5. #5

    My post count is Majestic

    northernladuk has reached the peak. Play again?

    northernladuk's Avatar
    Join Date
    Mar 2009
    Posts
    44,259

    Default

    Did you send you Gladatorial School Certificate of Merit as well.
    'CUK forum personality of 2011 - Winner - Yes really!!!!

  6. #6

    Contractor Among Contractors

    Yorkie62 is NOT a disguised employee


    Join Date
    Nov 2015
    Location
    Omnipresent
    Posts
    1,813

    Default

    Quote Originally Posted by northernladuk View Post
    Did you send you Gladatorial School Certificate of Merit as well.
    NO juts some pictures of particularly interesting church and cathedral spires he has visited recently.

  7. #7

    Should post faster

    man is too good to be a permie


    Join Date
    Oct 2017
    Posts
    133

    Default

    I've had the passport request a number of times. If you're particularly bothered about the security side (especially as they're asking for quite a bit all at once there), host a relatively low quality scanned copy on your own HTTPS website or on a secured AWS S3 bucket or whatever you think mitigates the unencrypted email risk sufficiently. And give them the link, and have it expire/ delete the file automatically after 7 days or whatever.

    Then cross your fingers and hope they don't just email it on to the client...

  8. #8

    Super poster

    fullyautomatix is NOT a disguised employee

    fullyautomatix's Avatar
    Join Date
    Feb 2010
    Location
    Gaul
    Posts
    4,674

    Default

    Quote Originally Posted by contractUKonline View Post
    Hey all,

    I’ve just landed a new contract - as part of the recruitment company’s vetting process they are asking for copies of my passport, address and NI number. This is on top of all the company documentation.

    I have two issues:
    1) is this legally required? I am technically employed by my company, this is who the contract is between the recruiter and the limited company - is there any need for my personal documents? Also I don’t understand at all why they need my NI number...

    2) they’ve just requested it over email - they don’t have an encryption process etc and when I’ve asked grandular questions about my data (where is it held, how long etc) they can’t answer.

    What would everyone do? Just send it? Query it more? Push back because it’s not needed?
    Definitely not normal. Push back and highlight your points as to why you won’t comply with their demands. Tell them in no uncertain terms that they are being very unreasonable and if they don’t drop their demands you will withdraw your application. Give them a deadline as well. Watch how they change tracks within minutes. Done it many times over the years.
    Vote Corbyn ! Save this country !

  9. #9

    Double Godlike!

    Mordac is a fount of knowledge

    Mordac's Avatar
    Join Date
    Jul 2005
    Location
    Civilisation-ish
    Posts
    10,269

    Default

    Quote Originally Posted by contractUKonline View Post
    Hey all,

    I’ve just landed a new contract - as part of the recruitment company’s vetting process they are asking for copies of my passport, address and NI number. This is on top of all the company documentation.

    I have two issues:
    1) is this legally required? I am technically employed by my company, this is who the contract is between the recruiter and the limited company - is there any need for my personal documents? Also I don’t understand at all why they need my NI number...

    2) they’ve just requested it over email - they don’t have an encryption process etc and when I’ve asked grandular questions about my data (where is it held, how long etc) they can’t answer.

    What would everyone do? Just send it? Query it more? Push back because it’s not needed?
    https://www.nationalarchives.gov.uk/...h-passport.pdf

    Read section 3.2 on P4, and make your own conclusions.
    His heart is in the right place - shame we can't say the same about his brain...

  10. #10

    Nervous Newbie

    contractUKonline has no reputation


    Join Date
    Nov 2016
    Posts
    12

    Default

    Thanks for the replies


    You are correct that your company is the one with the legal obligation to validate that you are entitled to work in the UK. Assuming you are outside IR35 (i.e. not an employee of the client or agency).

    However, the client could end up in hot water if they are found to have a load of illegals working on their site so they insist on extra checks as part of their due dilligence.

    If you're concerned about email then send the passport by registered post.
    Hmmm....I get this. However they also want an NI number, certified address.... I think it's overkill and risky for me to send over this volume of information. A passport I can make peace with but like you said they have no legal remit.

    https://www.nationalarchives.gov.uk/...h-passport.pdf
    Read section 3.2 on P4, and make your own conclusions.
    This definitely treats a copy of the passport with a lot more weight and echoes how I feel about this - I'm assuming this is old, I wonder if there's a 2019 version.

    Definitely not normal. Push back and highlight your points as to why you won’t comply with their demands. Tell them in no uncertain terms that they are being very unreasonable and if they don’t drop their demands you will withdraw your application. Give them a deadline as well. Watch how they change tracks within minutes. Done it many times over the years
    I sort of am, but not so aggressively as I do actually want the contract. Thanks for letting me know this isn't normal in your experience, i've never had this before.

    I've had the passport request a number of times. If you're particularly bothered about the security side (especially as they're asking for quite a bit all at once there), host a relatively low quality scanned copy on your own HTTPS website or on a secured AWS S3 bucket or whatever you think mitigates the unencrypted email risk sufficiently. And give them the link, and have it expire/ delete the file automatically after 7 days or whatever.

    Then cross your fingers and hope they don't just email it on to the client...
    This is true, but even that type of link isn't secure.. once downloaded they can do anything with it. It's not like I believe they have negative intensions, I just think they're trying to cover all bases but it's too much IMHO

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •