Captured source text (L5)
5. Using a holder service to conduct a right to work check
5.a. Passports and passport cards can be withdrawn or cancelled, and right to work checks are not transferrable from one employer to another. As such, if you want to use a pre-existing identity stored in a holder service to conduct a right to work check, you must be able to assure the employer that the user holds a British passport, Irish passport or Irish passport card at the time the check is conducted, and that the passport or passport card is not visibly clipped or expired by more than 6 months by conducting a [GPG 45 validity check](https://www.gov.uk/government/publications/how-to-check-someones-identity-1-0/how-to-check-someones-identity-1-0-pre-release#section-6) on it. If an expired passport or passport card is used, it must be validated according to 3.2.b.
5.b. While right to work checks are not transferrable from one employer to another, an employer, individual or other organisation (‘relying party’) may need to check whether a worker has already had a right to work check conducted. If you want to use a pre-existing identity stored in a holder service to check that an individual carrying out work or services has had their right to work checked and confirmed, you must:
- know whether the user of the holder service account (‘user’) is the same person as the worker on whom the right to work check was conducted (‘worker’)
- know that this right to work check was successful and remains valid
- confirm to the relying party whether the user is the same person as the worker.
5.c. If you conduct a check as described in 5.a or 5.b, you must follow [the rules for holder service providers](https://www.gov.uk/government/publications/uk-digital-verification-services-trust-framework-1-0/uk-digital-verification-services-trust-framework-1-0-pre-release#section-7) set out in the trust framework and the holder service must have medium protection using medium quality authenticators as a minimum according to [GPG 44](https://www.gov.uk/government/publications/how-to-use-authenticators-to-protect-an-online-service-1-0).
5.d. To conduct a right to work check as described in 5.a, you must know the pre-existing identity was created in line with 3.2, and you must share the data in 4.a with the employer.
5.e. If you have conducted a check as described in 5.b., and you have successfully matched the user with the worker on whom the right to work check was conducted, you must be able to share the following information upon request from a relying party:
- an image of the user captured during the check if such an image is available; and
- the image from the right to work check that you matched them against.
You must only share this information if you have agreed to supply it to the relying party and if you have confirmation that the user understands that this information will be shared. You must agree with the relying party how long you will retain this information for if you have agreed to supply it.
The relying party is not obliged to request this information, but may do so, for example, for compliance purposes.
Full captured verbatim text
5.a. Passports and passport cards can be withdrawn or cancelled, and right to work checks are not transferrable from one employer to another. As such, if you want to use a pre-existing identity stored in a holder service to conduct a right to work check, you must be able to assure the employer that the user holds a British passport, Irish passport or Irish passport card at the time the check is conducted, and that the passport or passport card is not visibly clipped or expired by more than 6 months by conducting a [GPG 45 validity check](https://www.gov.uk/government/publications/how-to-check-someones-identity-1-0/how-to-check-someones-identity-1-0-pre-release#section-6) on it. If an expired passport or passport card is used, it must be validated according to 3.2.b. 5.b. While right to work checks are not transferrable from one employer to another, an employer, individual or other organisation (‘relying party’) may need to check whether a worker has already had a right to work check conducted. If you want to use a pre-existing identity stored in a holder service to check that an individual carrying out work or services has had their right to work checked and confirmed, you must: - know whether the user of the holder service account (‘user’) is the same person as the worker on whom the right to work check was conducted (‘worker’) - know that this right to work check was successful and remains valid - confirm to the relying party whether the user is the same person as the worker. 5.c. If you conduct a check as described in 5.a or 5.b, you must follow [the rules for holder service providers](https://www.gov.uk/government/publications/uk-digital-verification-services-trust-framework-1-0/uk-digital-verification-services-trust-framework-1-0-pre-release#section-7) set out in the trust framework and the holder service must have medium protection using medium quality authenticators as a minimum according to [GPG 44](https://www.gov.uk/government/publications/how-to-use-authenticators-to-protect-an-online-service-1-0). 5.d. To conduct a right to work check as described in 5.a, you must know the pre-existing identity was created in line with 3.2, and you must share the data in 4.a with the employer. 5.e. If you have conducted a check as described in 5.b., and you have successfully matched the user with the worker on whom the right to work check was conducted, you must be able to share the following information upon request from a relying party: - an image of the user captured during the check if such an image is available; and - the image from the right to work check that you matched them against. You must only share this information if you have agreed to supply it to the relying party and if you have confirmation that the user understands that this information will be shared. You must agree with the relying party how long you will retain this information for if you have agreed to supply it. The relying party is not obliged to request this information, but may do so, for example, for compliance purposes.