are companies allowed to hold on to your passport?