Employee Identity Verification

An employer needs it at each point where a mistake about who someone is would give the wrong person access, money or authority. Most organisations have four such points.

The first is hiring. The employer has to know that the person who accepted the offer is the person who was interviewed, and that the name on the contract is theirs. Many countries also require employers to check a new hire's right to work, and that check starts from an identity document.

The second is first access. A laptop, an email account and a set of permissions are issued to a named person. If they reach someone else, every later control is built on a false start.

The third is recovery. An employee who has lost a phone or forgotten a password asks for a reset. The help desk has to decide whether the caller is that employee.

The fourth is signing. An employment contract, a confidentiality undertaking or a share option agreement binds a specific person, so the employer needs evidence of who signed.

No single EU law prescribes how an employer must verify identity. The duty comes from several directions: national employment and immigration law, sector rules for regulated roles, the employer's own security obligations, and the plain need to know who is on the payroll. Remote hiring across borders has made the question harder, because the employer may never be in the same room as the new hire.

It works like any remote identity check. The person presents an official identity document, and a live image of their face is compared with the photo in it. The employer sends an invitation, the new hire completes the check on their own phone, and the employer receives the result.

Two things are specific to employment. The first is the link to what comes next. The check has to be tied to something the employee will use afterwards. A verified identity that is not connected to the account, the device or the signing certificate shows only that a real person exists somewhere. The stronger design issues the first credential as the direct outcome of the check, in the same session where possible.

The second is timing. If verification happens after the laptop has been shipped and the account created, it is a formality. It belongs before first access.

Employers that hire in several countries also meet the limits of local identity schemes. A national electronic identity serves residents of that country. It does nothing for a hire from elsewhere. A check based on a passport, which a hire from any country can present, avoids running a different process for each place.

The quality of the method matters as much here as in client work. The questions are the same. Does the method test that the document is genuine? Does it test that a live person is present? Can it detect video that has been fed into the system instead of captured by the camera?

The two can be a single step when the documents are signed with a qualified electronic signature. A qualified trust service provider must verify the identity of a person before it issues the certificate behind such a signature (Article 24(1) of the eIDAS Regulation). The employer therefore gets an identity check and a signature from one process, and the signed document names a verified person.

The legal effect is set at EU level. A qualified electronic signature has the equivalent legal effect of a handwritten signature (Article 25(2)). One based on a qualified certificate issued in one member state is recognised as qualified in all the others (Article 24a(1)). That matters to an employer with staff in several countries. Microsoft, for example, onboards and signs new EU employees remotely with ZealiD qualified signatures through Adobe Acrobat Sign.

Which employment documents need that level is a national question. Some member states require written form for particular documents, and national law decides whether an electronic signature satisfies the requirement and at which level. An employer should check the rule for each country where it hires.

Where no form is required, a simpler signature is valid. Article 25(1) stops a court from refusing an electronic signature as evidence solely because it is electronic or because it is not qualified. The employer then has to show who signed if the signature is ever disputed. A separate identity check, recorded at the time, is the evidence for that.

The GDPR requires a lawful basis, a limit on what is collected and, for the face comparison, a specific exception. The employer is the controller of the data it collects about its staff.

Lawful basis comes first. Processing is lawful where it is necessary for a contract with the person, or for steps taken at their request before entering into one. It is also lawful where it is necessary for a legal obligation of the controller (Article 6(1)(b) and (c)). Hiring and right-to-work duties usually fit one of these. Consent is a weaker footing in employment, because data protection authorities doubt that an employee is free to refuse.

The face comparison is the harder part. A facial image processed by technical means to confirm who someone is counts as biometric data (Article 4(14)). Processing biometric data to uniquely identify a person is prohibited unless an exception applies (Article 9(1)). One exception covers processing that is necessary for obligations and rights in the field of employment law, in so far as Union law, member state law or a collective agreement authorises it. Another is explicit consent (Article 9(2)(a) and (b)). Member states may set more specific rules for employee data under Article 88. An employer should check the national position before choosing a method, and offer another route to anyone who declines the biometric step.

Then comes minimisation. Data must be adequate, relevant and limited to what is necessary. It must be kept no longer than necessary (Article 5(1)(c) and (e)). In many cases the employer needs the outcome of the check with its date, not a copy of the passport. The new hire must be told the purposes and the legal basis when the data is collected (Article 13(1)(c)). Where an outside provider runs the check on the employer's behalf, a contract that meets Article 28 is needed.

It matters because one of the simplest ways into an organisation is to pretend to be someone who already works there. An attacker who cannot break a password can ask for it to be reset. The call to the help desk is short and plausible: a new phone, a locked account, a deadline. Suppose the help desk checks identity with questions whose answers can be found online or guessed, such as a date of birth or a manager's name. The reset goes to the attacker, and every control that follows treats them as the employee.

Multi-factor authentication does not close this gap alone. It protects the login. The reset process is the route around it, and a second factor that can be re-issued over the phone is only as strong as the phone call.

The answer is to repeat the identity check at the moments that carry the most risk, at the strength used on the first day. Those moments include enrolling a new device, recovering an account, granting administrator rights and changing salary payment details. A face comparison against the identity verified at hiring cannot be answered from a social media profile.

Voice and video are no longer proof in themselves. Synthetic audio and video can imitate a colleague well enough to pass a casual check, so recognising someone on a call is weak evidence. A check with liveness detection, protected against injected video, is a stronger test than a familiar face on a screen.

Identity verification asks whether the person is who they say they are. A background check asks what is true about that person: their qualifications, their employment history, their references and, for some roles, their criminal record. The first has to come before the second. A background check run on a false identity confirms the history of somebody else.

The two also fall under different rules. Identity verification uses an identity document and a face. Background checks reach into data that the GDPR guards more closely. Personal data on criminal convictions and offences may be processed only under the control of official authority, or where Union or member state law authorises the processing with appropriate safeguards (Article 10). National law therefore decides which roles can be checked, and how.

Keeping the two apart helps with data minimisation as well. The identity check should produce a yes or a no, with a record of how the answer was reached. It should not grow into a general file on the candidate.