1. (1) A relying party shall:

   1. (a) incorporate state-of-the-art safeguards for protecting an individual's identity in the verification process;
   2. (b) comply with the requirements of this part through technological means where possible;
   3. (c) process an individual's identity attributes in a secure manner;
   4. (d) process only the minimum identity attributes reasonably necessary to achieve a specified purpose; and
   5. (e) accept a presentation of a state-endorsed digital identity by a digital guardian.

2. (2) A relying party may only process an individual's identity attributes from a state digital identity if:

   1. (a) authorized by the holder;
   2. (b) the processing is necessary for a specified purpose;

   3. (c) the holder has received conspicuous notice of:

      1. (i) what identity attributes are collected;
      2. (ii) how the identity attributes are used;
      3. (iii) the purpose for which the identity attributes are processed; and
      4. (iv) how long the identity attributes are retained; and
   4. (d) the holder consents to the processing of the identity attributes.
3. (3) A relying party may not require a holder to surrender the holder's secure electronic device in the course of a presentation.
4. (4) A relying party may accept a state-endorsed digital identity as proof of an individual's identity or identity attributes unless a different method of proof is required by law.
5. (5) Nothing in this section relieves a relying party from complying with the requirements of Title 13, Chapter 44, Protection of Personal Information Act, or Title 13, Chapter 61, Utah Consumer Privacy Act.

Enacted by Chapter 436, 2026 General Session