Part 7: General Requirements

Duty of Loyalty

SEDI-LOY-01: No conflicting practices

Refrain from practices that conflict with the best interests of an individual.

Utah Code § 63A-20-701(1)

Requirement: All ecosystem participants SHALL design and operate systems in the individual's best interest. Systems SHALL NOT include dark patterns, deceptive interfaces, or features that manipulate holders into disclosing more information than necessary.

Criticality: High — Dark patterns or manipulative interfaces undermine holder autonomy and violate the statutory duty of loyalty.

Roles: Department, Wallet Providers, Verifiers, Relying Parties, Digital Guardians

Assessment Objectives

Determine if:

1. system designs and user interfaces do not include dark patterns, deceptive interfaces, or confirm-shaming language;
2. default settings favor minimum disclosure rather than maximum data sharing;
3. consent flows and disclosure prompts present choices in the holder's best interest;
4. UI nudges do not manipulate holders into disclosing more information than necessary;
5. ecosystem participant agreements prohibit practices that conflict with the individual's best interests;
6. a complaint channel exists for reporting manipulative interfaces.

Verification Methods

Objective coverage: AUTO → 1, 2; EXPT → 1, 3, 4; ADMN → 5, 6

Assessment objects: Wallet and verifier application UI mockups and source code; consent flow screenshots and interaction recordings; default configuration settings for disclosure and sharing; ecosystem participant agreements and terms of service; complaint records related to manipulative interfaces; UX design review reports.

Statutory compliance: Expert review is mandatory because identifying practices that conflict with an individual's best interests requires human judgment about UI design intent and effect. Automated scanning supplements by flagging known anti-patterns.

SEDI-LOY-02: No exploitation of individuals

Refrain from taking advantage of or otherwise exploiting an individual.

Utah Code § 63A-20-701(2)

Requirement: No ecosystem participant SHALL exploit holder data for purposes beyond the holder's authorization. No participant SHALL leverage its role to extract value from holders' identity data.

Criticality: High — Exploitation of identity data violates the fiduciary-like duty of loyalty and erodes public trust.

Roles: Department, Wallet Providers, Verifiers, Relying Parties, Digital Guardians

Assessment Objectives

Determine if:

1. no ecosystem participant monetizes holder data without explicit holder authorization;
2. business models of ecosystem participants do not exploit information asymmetry between participants and holders;
3. participant agreements include anti-exploitation clauses prohibiting value extraction from holders' identity data;
4. data flows do not enable participants to leverage their role to extract value beyond authorized purposes;
5. complaint records are reviewed for exploitation allegations and resolved appropriately. 

Verification Methods

Objective coverage: EXPT → 4; ADMN → 1, 2, 3, 5

Assessment objects: Participant business model disclosures and revenue documentation; data-sharing agreements and monetization contracts; participant agreements and anti-exploitation clauses; data flow diagrams and access pattern logs; complaint records and resolution documentation; holder authorization records for any secondary data use.

Statutory compliance: Administrative verification is mandatory because whether an entity "exploits" or "takes advantage of" an individual requires contextual, fiduciary-standard judgment that cannot be reduced to technical tests.

SEDI-LOY-03: No disproportionate risk

Refrain from disproportionate risk to an individual.

Utah Code § 63A-20-701(3)

Requirement: Systems SHALL be designed to minimize risk to individuals. The risk of credential compromise, identity theft, or privacy violation SHALL be proportionate to the benefits of the system.

Criticality: High — Disproportionate risk to individuals violates the statutory duty of loyalty and may expose holders to identity theft or privacy violations.

Roles: All ecosystem participants

Assessment Objectives

Determine if:

1. systems are designed to minimize risk of credential compromise, identity theft, and privacy violation to individuals;
2. security controls (encryption, access controls) meet baseline thresholds;
3. risk mitigation measures are proportionate to the benefits the system provides;
4. a current risk assessment exists evaluating threat vectors against individuals;
5. participant agreements require risk proportionality analysis;
6. incident history is reviewed for patterns indicating disproportionate risk to individuals.

Verification Methods

Objective coverage: AUTO → 2; EXPT → 1, 3, 4; ADMN → 4, 5, 6

Assessment objects: Risk assessment reports and threat models; vulnerability scan results and remediation records; security control configuration documentation; participant agreements with risk proportionality clauses; incident and breach records; system architecture and data flow diagrams; penetration test reports.

Statutory compliance: Expert review is mandatory because assessing whether risk is "disproportionate" requires professional judgment weighing technical threat vectors against system benefits. Automated scanning supplements by verifying baseline security controls.

SEDI-LOY-04: No detriment

[Refrain from practices] that [...] (4) are to an individual's detriment.

Utah Code § 63A-20-701(4)

Requirement: No ecosystem participant SHALL engage in practices related to identity attribute processing that are to an individual's detriment.

Criticality: High — Detrimental practices violate the statutory duty of loyalty and may cause tangible harm to individuals.

Roles: All ecosystem participants

Assessment Objectives

Determine if:

1. no ecosystem participant engages in practices related to identity attribute processing that are to an individual's detriment;
2. complaint mechanisms exist and are accessible for reporting detrimental practices;
3. complaint records are reviewed for patterns of detrimental outcomes;
4. remediation procedures are in place for addressing identified detrimental practices.

Verification Methods

Objective coverage: ADMN → 1, 2, 3, 4

Assessment objects: Participant practice documentation and operational procedures; complaint submission records and resolution logs; remediation plans and corrective action reports; participant agreements and codes of conduct; holder outcome surveys or feedback records.

Statutory compliance: Only administrative verification is feasible because determining whether a practice is "to an individual's detriment" requires contextual human judgment about real-world outcomes that cannot be reduced to automated or technical checks.

SEDI-LOY-05: No harm

[Refrain from practices] that [...] (5) cause harm to an individual.

Utah Code § 63A-20-701(5)

Requirement: No ecosystem participant SHALL engage in practices related to identity attribute processing that cause harm to an individual.

Criticality: High — Harmful practices violate the statutory duty of loyalty and may expose the program to enforcement action.

Roles: All ecosystem participants

Assessment Objectives

Determine if:

1. no ecosystem participant engages in practices related to identity attribute processing that cause harm to an individual;
2. complaint mechanisms exist and are accessible for reporting harmful practices;
3. complaint and incident records are reviewed for evidence of harm to individuals;
4. harm mitigation and remediation procedures exist and are documented;
5. incident response processes address harms promptly when identified.

Verification Methods

Objective coverage: ADMN → 1, 2, 3, 4, 5

Assessment objects: Participant practice documentation and operational procedures; complaint submission records and resolution logs; incident reports and harm assessments; harm mitigation and remediation plans; participant agreements with harm-prevention clauses; incident response procedures and timelines.

Statutory compliance: Only administrative verification is feasible because "harm" is a contextual judgment about real-world outcomes that cannot be fully reduced to programmatic rules or technical checks.

Processing Restrictions

SEDI-PRC-01: Purpose-limited record processing

Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party: (a) for the primary purpose for which the presentation was performed; or (b) if required by law.

Utah Code § 63A-20-702(1)

Requirement: Presentation records (logs, receipts, cached attributes) SHALL be tagged with the purpose for which the presentation was made. Processing of those records for any other purpose is prohibited unless required by law.

Criticality: Critical — Unauthorized secondary processing of presentation records violates the core data-use restriction and exposes holders to tracking and profiling.

Roles: Wallet Providers, Verifiers, Relying Parties

Assessment Objectives

Determine if:

1. presentation records (logs, receipts, cached attributes) are tagged with the purpose for which the presentation was made;
2. processing of presentation records for any purpose other than the tagged purpose is rejected;
3. legal-exception processing paths require an auditable justification parameter;
4. purpose enforcement mechanisms cannot be bypassed through alternative code paths or API calls;
5. no secondary processing pipelines exist outside the purpose-tagged path;
6. participant agreements prohibit secondary processing of presentation records;
7. legal-exception use is documented and auditable.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 4, 5; ADMN → 6, 7

Assessment objects: Presentation record schemas and purpose-tag field definitions; API endpoint documentation and access control configurations; purpose-enforcement source code and middleware; data flow diagrams showing processing pipelines; participant agreements with secondary-processing prohibitions; legal-exception logs and justification records; audit trail exports.

Statutory compliance: Automated testing is mandatory because purpose-limited processing is a directly enforceable technical constraint. Expert review supplements by verifying enforcement cannot be bypassed. Administrative review ensures contractual and legal-exception governance.

SEDI-PRC-02: Primary purpose limitation

Information provided in the course of a presentation may only be processed for the primary purpose for which the holder disclosed the information.

Utah Code § 63A-20-702(2)(a)

Requirement: Attribute data received during a presentation SHALL NOT be repurposed, aggregated with other data, or used for profiling, marketing, or analytics beyond the stated presentation purpose.

Criticality: Critical — Repurposing disclosed attributes for profiling or analytics violates the holder's consent scope and statutory processing restrictions.

Roles: Verifiers, Relying Parties

Assessment Objectives

Determine if:

1. presentation data is stored in purpose-scoped containers with data segregation enforced;
2. cross-purpose queries or joins across presentation datasets are rejected;
3. no analytics, profiling, or marketing endpoints accept presentation-sourced data;
4. no aggregation pipelines combine presentation data across purposes;
5. attribute data received during a presentation is not repurposed beyond the stated presentation purpose;
6. participant agreements explicitly prohibit repurposing, aggregation, and profiling of presentation data.

Verification Methods

Objective coverage: AUTO → 1, 2, 3; EXPT → 4, 5; ADMN → 6

Assessment objects: Data storage architecture and container isolation documentation; database schemas showing purpose-scoped partitioning; API endpoint configurations and query restrictions; data flow diagrams and pipeline inventories; participant agreements with repurposing and profiling prohibitions; data-use policy documents; analytics platform configurations.

Statutory compliance: Automated testing is mandatory because data segregation and access restrictions are directly enforceable technical properties. Expert review supplements by verifying no hidden aggregation pipelines exist. Administrative review ensures contractual prohibition.

SEDI-PRC-03: Notice and consent for secondary use

Used, retained, sold, or shared: (i) following conspicuous notice to and express authorization by the holder; or (ii) if required by law.

Utah Code § 63A-20-702(2)(b)

Requirement: Retention, sharing, or sale of presentation data beyond the primary purpose SHALL require: (a) conspicuous notice to the holder describing the secondary use, AND (b) express (opt-in) authorization from the holder. Legal requirements are the only alternative basis.

Criticality: Critical — Secondary use without notice and express consent violates the holder's data sovereignty and statutory consent requirements.

Roles: Verifiers, Relying Parties

Assessment Objectives

Determine if:

1. secondary-use data operations require a valid consent token linked to the holder's express authorization;
2. the consent mechanism is opt-in (default state is non-consent), not opt-out;
3. data retention, sharing, or sale APIs reject requests without a consent record;
4. conspicuous notice describing the secondary use is rendered to the holder before the authorization prompt;
5. the opt-in flow is not pre-selected or bundled with unrelated consents;
6. no secondary use of presentation data occurs without a corresponding consent record;
7. participant agreements require notice-and-consent for any secondary use;
8. consent records are retained and auditable.

Verification Methods

Objective coverage: AUTO → 1, 2, 3, 4; EXPT → 4, 5, 6; ADMN → 7, 8

Assessment objects: Consent token schemas and validation logic; consent UI mockups and notice content; default configuration for consent state; data retention, sharing, and sale API documentation; consent record storage and retrieval mechanisms; participant agreements with secondary-use provisions; audit trail of consent grants and revocations; notice placement and readability assessments.

Statutory compliance: Automated testing is mandatory because the consent-gating mechanism (opt-in default, consent token requirement, API rejection without consent) is a directly testable technical property. Expert review supplements by assessing notice conspicuousness and consent flow design.