By Daniel Whitmore, MSc in Industrial and Organizational Psychology
In short
Remote identity verification in assessment establishes that the person completing a session is the person who was invited, typically by comparing a document photograph and a session photograph. The comparison can be made by a named human reviewer or by automated matching, and the two differ sharply in data protection terms: automated matching generally involves creating biometric templates, which several regimes treat as a special category of personal data. A human comparison answers the same question without producing that data.
A candidate completes an assessment remotely. Nobody saw them sit down. Whether they are the person who applied is a fair question, and the answer determines what the score is worth.
It is also a question that can be answered several ways, and the methods differ far more in what they oblige you to hold afterwards than in what they establish.
Decide what you are protecting against
Impersonation is not evenly distributed across hiring. In most commercial recruitment it is rare, because the deception has to survive the interviews, the reference stage and then the job itself — the gain is small and short-lived.
In certification it is a live risk. A credential that opens a regulated activity has a value independent of the person holding it, which is exactly the condition that makes substitution worthwhile.
That difference should drive the decision, not the availability of the feature. An identity check on a thirty-minute screening task imposes friction on everyone to guard against something the next stage would catch anyway. The same check before a certification exam is proportionate.
What each method actually establishes
| Method | Establishes | Data it creates |
|---|---|---|
| Email invitation to a known address | the invitation reached an inbox | none beyond the invitation |
| Single-use code or credential | someone held the credential | an access record |
| Document photograph plus session photograph, human comparison | a document was presented and resembles the person on camera | two images |
| Automated face matching | a similarity score between two images | a biometric template |
| Document authenticity verification | the document itself appears genuine | document data, often with a third party |
Each row answers a narrower question than the one above suggests, and the gap between rows three and four is the one worth understanding.
Why the human comparison is the better default
Automated face matching and a human comparing two photographs answer the same practical question: is this plausibly the same person?
They differ in what the process produces. Automated matching generally works by deriving a mathematical representation of facial features — a template — and comparing templates. Under the GDPR and comparable regimes, biometric data processed for the purpose of uniquely identifying a natural person is a special category, with a higher bar for lawful processing and heavier obligations around storage, access and deletion.
A reviewer looking at two images makes a judgement and produces no template. The same question is answered; the special-category data is never created.
There is a second advantage and it is about fairness rather than compliance. A human comparison can be attributed and contested: the candidate can be told who made the decision and on what basis, and a disagreement has somewhere to go. A similarity score of 0.82 against a threshold of 0.85 is not something anyone can argue with, and published evaluations of facial recognition have repeatedly found error rates that differ across demographic groups — which means an automated threshold does not fail evenly.
Our own position, stated so it can be checked: identity photographs are compared by a named human reviewer. There is no automatic face matching and no biometric face template is created or stored.
Start-of-session is not continuity
An identity check at the beginning establishes who began. It says nothing about who was at the keyboard forty minutes later.
Continuity is a separate question with a separate cost — periodic images through the session, which multiplies the data you hold and the intrusion the candidate experiences. For most assessment the start-of-session check is the proportionate answer, because the substitution scenario it fails to catch (someone swapping in mid-task) is both rarer and more likely to show up in the work itself.
If the stakes genuinely require continuity, say so in the consent screen in those terms, keep the interval as long as the risk allows, and apply the same retention clock to every image.
Retention is the part that gets forgotten
Identity artefacts have a narrow purpose that expires quickly. Once the session is reviewed and the decision made, a photograph of someone's identity document serves no remaining use and accumulates risk every day it is held.
Three things to settle before the first session rather than after a request arrives:
- The period. Weeks rather than years, tied to the decision rather than to a general backup policy.
- The mechanism. Deletion on a schedule that runs itself, not on request. A policy that depends on someone remembering is a policy that quietly fails.
- The disclosure. The period told to the candidate at the point of collection, in the consent screen, in the same sentence as what is being collected.
Tell candidates before, not during
Nothing about an identity check should arrive as a surprise mid-flow. Before the session begins, the candidate should know what is collected, who looks at it, how long it is kept and what happens if the check is inconclusive.
That last one matters more than it seems. An inconclusive comparison — a poor-quality photograph, a document from an unfamiliar jurisdiction, a person who no longer resembles a five-year-old passport picture — is a common outcome and it is not a finding of dishonesty. Decide in advance what happens: a retry, a short live confirmation, a human review with a second pair of eyes. Deciding in the moment is how an identity check becomes an accusation.
- identity verification
- remote assessment
- biometrics
- data protection
- assessment integrity
Key takeaways
- Decide what you are protecting against first: impersonation at scale is rare in most hiring, and common in certification.
- Automated face matching creates biometric data. A named reviewer comparing two photographs answers the same question and creates none.
- An identity check at the start proves who started. Continuity through the session is a separate question with separate costs.
- Whatever you collect needs a retention clock set before the first session, not a policy written after someone asks.