Christopher Bramwell, Chief Privacy Officer for the State of Utah, addressed policymakers rather than technologists at our Hui. His central point was clear: almost every digital identity conversation focuses on technology and standards. Far fewer focus on governance. But governance is what determines the outcome.
Utah has passed the only comprehensive digital identity legislation in the United States, with other states now following. Four principles define its approach.
- Control sits with the person, in statute
No institution grants or revokes identity, and there is no fee to prove who you are. - A duty of loyalty replaces consent
Identity data is protected at source and cannot be used against the individual. Those protections cannot simply be consented away. - Disloyalty is named
Behavioural nudging, surveillance pricing and warrantless government access are explicitly addressed. - The state defines the market, not the products
Government endorses and regulates; the market builds wallets and verifier services.
The questions for Aotearoa are direct:
Where does our governance frame sit and who owns it? Is a loyalty standard a stronger test than notification and authorised purpose under the Privacy Act? What do New Zealand’s settings permit for government access to verified identity data (including data that is purchased rather than compelled)?
Any answer must treat Te Tiriti, Māori data sovereignty and privacy by design as core prerequisites.
Utah has extended an open invitation to a New Zealand delegation for its third multi-state convening in November. If you have a view on how a duty of loyalty could sit alongside New Zealand’s Privacy Act settings, bring it to our working group.