Part 6: Relying Parties

Implementation Decisions

Before the requirements in this part can be assessed, the responsible parties must specify:

• Security baseline standard (SEDI-RPY-01): references a recognized security framework for relying party systems
• Purpose-to-attribute mapping (SEDI-RPY-04): documents each use case and the specific attributes required

SEDI-RPY-01: Identity protection safeguards

Incorporate state-of-the-art safeguards for protecting an individual's identity in the verification process.

Utah Code § 63A-20-601(1)(a)

Requirement: The relying party system SHALL implement current best-practice security controls for handling verified identity attributes.

Criticality: Critical — Weak relying party security would expose holder attribute data after verification, creating a downstream attack surface.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. verified identity attributes are encrypted in transit between the verification endpoint and the relying party system;
2. verified identity attributes are encrypted at rest within the relying party's data stores;
3. access controls restrict identity data to authorized personnel and systems within the relying party organization;
4. the relying party implements current best-practice security controls as defined by the organization's security baseline standard.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 3, 4; ADMN → 4

Assessment objects: relying party integration endpoint source code and configuration; TLS/encryption configuration for data channels; data-at-rest encryption implementation; access control lists and role definitions; internal data flow architecture documentation; security baseline policy document; security certifications and third-party attestation reports.

Statutory compliance: Automated testing is mandatory because encryption and access controls are deterministic technical properties verifiable through testing at the integration boundary.

SEDI-RPY-02: Technological compliance

Comply with the requirements of this part through technological means where possible.

Utah Code § 63A-20-601(1)(b)

Requirement: Compliance with Part 6 requirements SHALL be enforced through technical controls where feasible.

Criticality: High — Relying on policy-only compliance where technical controls are feasible creates preventable compliance gaps.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. each Part 6 requirement that can be enforced through technological means is implemented as a technical control rather than a policy-only control;
2. any requirement enforced solely through policy has a documented justification explaining why technical enforcement is not feasible;
3. the set of policy-only exceptions is reviewed periodically for feasibility of conversion to technical controls.

Verification Methods

Objective coverage: AUTO → 1; EXPT → 1, 2, 3; ADMN → 2, 3

Assessment objects: relying party application source code and configuration; technical control inventory mapping each RPY requirement to its enforcement mechanism; policy-only exception register with feasibility justifications; exception review records and meeting minutes.

Statutory compliance: Expert review is mandatory because determining whether a requirement can be "technically enforced" requires judgment about technical feasibility that cannot itself be automated.

SEDI-RPY-03: Secure attribute processing

Process an individual's identity attributes in a secure manner.

Utah Code § 63A-20-601(1)(c)

Requirement: The relying party SHALL process attributes securely. Attribute data SHALL NOT be logged in plaintext beyond what is necessary for the specified purpose, cached beyond the transaction, or exposed to unauthorized systems.

Criticality: Critical — Insecure relying party attribute processing creates long-term identity data exposure risk.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. attribute data is not logged in plaintext beyond what is necessary for the specified purpose;
2. attribute data is not cached beyond the scope of the current transaction;
3. attribute data is not exposed to unauthorized systems or components within the relying party's environment;
4. data retention is limited to the duration and scope required by the relying party's stated purpose;
5. the relying party processes attributes within a secure execution context.

Verification Methods

Objective coverage: AUTO → 1, 2, 4; EXPT → 3, 5; ADMN → 4, 5

Assessment objects: relying party application source code; logging configuration and log output samples; attribute data lifecycle documentation; data retention policies and purge schedules; access control lists and role definitions; secure processing procedure documentation; execution environment isolation configuration.

Statutory compliance: Automated testing is mandatory because plaintext logging, access controls, and data retention are deterministic technical properties verifiable through testing at the integration boundary.

SEDI-RPY-04: Minimum attribute processing

Process only the minimum identity attributes reasonably necessary to achieve a specified purpose.

Utah Code § 63A-20-601(1)(d)

Requirement: The relying party SHALL define and document the specific purpose for which identity attributes are needed and SHALL request only the minimum attributes necessary for that purpose.

Criticality: High — Over-collection by relying parties increases the attack surface and violates statutory data minimization requirements.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party has defined and documented the specific purpose for which identity attributes are needed;
2. the relying party requests only the attributes specified in the purpose-to-attribute mapping;
3. the set of requested attributes is proportionate to the stated purpose and does not include attributes unrelated to that purpose;
4. the relying party does not retain attributes beyond what is necessary for the stated purpose.

Verification Methods

Objective coverage: AUTO → 2, 3; EXPT → 1, 2, 3, 4; ADMN → 1

Assessment objects: relying party purpose documentation and data use justifications; purpose-to-attribute mapping register; attribute request configuration and API specifications; data retention policies; relying party privacy impact assessment; attribute request logs showing requested attributes per transaction type.

Statutory compliance: Expert review is mandatory because determining whether attributes are "reasonably necessary" for a stated purpose requires contextual judgment; automated testing is recommended for detecting obvious over-collection.

SEDI-RPY-05: Accept guardian presentations

Accept a presentation of a state-endorsed digital identity by a digital guardian.

Utah Code § 63A-20-601(1)(e)

Requirement: The relying party SHALL accept guardian presentations on the same terms as direct holder presentations, where the guardian is authorized.

Criticality: High — Rejecting guardian presentations would exclude minors and incapacitated individuals from services.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party accepts presentations made by a digital guardian on behalf of the subject;
2. the guardian's authorization is validated before the presentation is accepted;
3. guardian presentations are accepted on the same terms as direct holder presentations;
4. no service degradation, additional requirements, or reduced functionality applies to guardian presentations compared to direct holder presentations.

Verification Methods

Objective coverage: AUTO → 1, 2, 4; EXPT → 3, 4; ADMN → 3, 4

Assessment objects: relying party application source code for guardian presentation handling; guardian authorization validation logic; service-level comparison test results for guardian vs. direct holder presentations; relying party integration documentation; terms of service and user-facing policies regarding guardian presentations.

Statutory compliance: Automated testing is mandatory because guardian presentation acceptance and service parity are deterministic protocol behaviors verifiable through testing.

SEDI-RPY-06: Four-condition processing gate

May only process attributes if: (a) authorized by holder; (b) necessary for specified purpose; (c) holder received conspicuous notice; (d) holder consents.

Utah Code § 63A-20-601(2)

Requirement: The relying party SHALL NOT process attributes unless all four conditions are met.

Criticality: Critical — Processing attributes without meeting all four conditions violates holder privacy protections and statutory consent requirements.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party does not process attributes until the holder has authorized the specific attribute release;
2. the attributes processed are necessary for the relying party's specified purpose;
3. the holder receives conspicuous notice of which attributes are being requested, by whom, and for what purpose before attribute processing;
4. the holder's explicit consent is captured before the relying party processes attributes;
5. the protocol enforces all four conditions sequentially such that failure of any single condition prevents attribute processing;
6. no bypass path, error-handling branch, or fallback flow exists that skips one or more of the four conditions.

Verification Methods

Objective coverage: AUTO → 1, 4, 5; EXPT → 3, 6; ADMN → 2, 3

Assessment objects: relying party integration source code and configuration; consent and authorization handling implementation; holder notice content, format, and delivery mechanism; consent capture and storage implementation; protocol flow test results demonstrating four-condition enforcement; error-handling and fallback path documentation; purpose documentation for each attribute request type.

Statutory compliance: Automated testing is mandatory because the four-condition gate is a sequential protocol property verifiable through flow analysis and testing.

SEDI-RPY-07: No device surrender

May not require a holder to surrender the holder's secure electronic device in the course of a presentation.

Utah Code § 63A-20-601(3)

Requirement: The relying party SHALL NOT require device surrender. All interaction SHALL be contactless or remote.

Criticality: Critical — Device surrender creates physical security risks and enables potential credential theft or unauthorized data extraction.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party does not require the holder to surrender, dock, or physically connect their device during a presentation;
2. all relying party interactions support contactless or remote presentation;
3. no relying party workflow, user interface, or staff instruction directs the holder to hand over their device;
4. service is fully available through non-surrender presentation methods.

Verification Methods

Objective coverage: AUTO → 1, 2; EXPT → 1, 3; ADMN → 3, 4

Assessment objects: relying party integration protocol specification; hardware and reader specifications at service points; deployment and installation guides; staff training materials and operating procedures; user-facing application flow documentation; complaint/incident reports related to device surrender.

Statutory compliance: Automated testing is mandatory because contactless interaction is a protocol-level property verifiable through specification and testing.

SEDI-RPY-08: Permissive SEDI acceptance

A relying party may accept a state-endorsed digital identity as proof of an individual's identity or identity attributes unless a different method of proof is required by law.

Utah Code § 63A-20-601(4)

Requirement: Relying parties MAY accept SEDI as proof of identity. Acceptance is permissive, not mandatory (for non-governmental relying parties). Where law requires a specific form of proof, that legal requirement takes precedence.

Criticality: Medium — Misunderstanding the permissive nature of SEDI acceptance could lead to legal conflicts where specific proof forms are required by law.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party's decision to accept or not accept SEDI is documented;
2. no legal requirement mandates a different method of proof that would conflict with SEDI acceptance for the relying party's specific use case;
3. where a legal exception applies, the relying party has identified and documented the conflicting legal requirement;
4. SEDI acceptance is treated as permissive (not mandatory) for non-governmental relying parties.

Verification Methods

Objective coverage: EXPT → 1, 2, 3; ADMN → 1, 2, 3, 4

Assessment objects: relying party SEDI acceptance policy documentation; legal analysis of applicable proof-of-identity requirements for the relying party's use cases; documented legal exceptions and conflicting statutory requirements; relying party terms of service referencing SEDI acceptance.

Statutory compliance: Administrative verification is mandatory because SEDI acceptance is a permissive legal authorization requiring case-by-case assessment of applicable law; expert legal review is recommended for specific use cases.

SEDI-RPY-09: Utah data protection law compliance

Nothing in this section relieves a relying party from complying with Utah Code Title 13, Chapter 44 or Utah Code Title 13, Chapter 61.

Utah Code § 63A-20-601(5)

Requirement: Relying parties SHALL comply with all applicable Utah data protection laws in addition to Chapter 63A-20 requirements.

Criticality: High — Non-compliance with existing data protection law exposes holders to privacy harm and the relying party to legal liability.

Roles: Relying Parties

Assessment Objectives

Determine if:

1. the relying party maintains compliance with Utah Code Title 13, Chapter 44 (Protection of Personal Information Act) as applicable to identity data received through SEDI presentations;
2. the relying party maintains compliance with Utah Code Title 13, Chapter 61 (Utah Consumer Privacy Act) as applicable to identity data received through SEDI presentations;
3. compliance obligations under Titles 13-44 and 13-61either statute are documented and integrated into the relying party's data handling procedures;
4. Chapter Utah Code Title 63A, Chapter -20 compliance is not treated as a substitute for pre-existing data protection obligations.

Verification Methods

Objective coverage: EXPT → 1, 2, 4; ADMN → 1, 2, 3, 4

Assessment objects: relying party compliance attestation documents for Title 13 Chapters 44 and 61; data handling procedures and privacy policies; compliance program documentation and audit reports; cross-reference matrix mapping data protection obligations to implemented controls; legal counsel opinions on applicability.

Statutory compliance: Administrative verification is mandatory because compliance with external data protection laws is a cross-cutting legal and organizational obligation; expert legal review is recommended for compliance assessment.