Rep. Norm Thurston — Voting Record

Bill

Number

S.B. 260 (2025GS)

Sponsor

Sen. Cullimore, Kirk A.

Final action

Governor Signed 3/25/2025

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• establishes guiding principles for the implementation of a state-endorsed digital identity;
• outlines state policy regarding state-endorsed digital identity;
• creates requirements for a state-endorsed digital identity program; and
• requires the Department of Government Operations to study and make recommendations regarding the implementation of a state-endorsed digital identity.

Every vote on this bill

Bill text

11
63A-16-1201
63A-16-1202
63A-16-1203
0
Individual Digital Identity Amendments
2025 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Kirk A. Cullimore
House Sponsor: Paul A. Cutler
LONG TITLE
General Description:
This bill enacts provisions related to a state-endorsed digital identity.
Highlighted Provisions:
This bill:
defines terms;
establishes guiding principles for the implementation of a state-endorsed digital identity;
outlines state policy regarding state-endorsed digital identity;
creates requirements for a state-endorsed digital identity program; and
requires the Department of Government Operations to study and make recommendations 
regarding the implementation of a state-endorsed digital identity.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
ENACTS:
63A-16-1201
, Utah Code Annotated 1953
63A-16-1202
, Utah Code Annotated 1953
63A-16-1203
, Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1, Section 
63A-16-1201
 is enacted to read:
12. State-endorsed Digital Identity
63A-16-1201
. Definitions.
As used in this part:
(1)
"Biometric data" means the same as that term is defined in Section 
13-61-101
.
(2)
"Chief privacy officer" means the chief privacy officer appointed in accordance with 
Section 
63A-19-302
.
(3)
"Digital identity" means an electronic record that an individual may use to assert the 
individual's identity.
(4)
"Governmental entity" means the same as that term is described in Section 
63G-2-103
.
(5)
(a)
"Guardian" means an individual or entity authorized to act on behalf of an 
individual.
(b)
"Guardian" includes:
(i)
a representative designated by an individual;
(ii)
the parent or legal guardian of an unemancipated minor; or
(iii)
the legal guardian of a legally incapacitated individual.
(6)
(a)
"Identity" means any attribute used to identify or distinguish a specific individual.
(b)
"Identity" includes an individual's:
(i)
personal data;
(ii)
biometric data;
(iii)
physical and non-physical characteristics;
(iv)
image or likeness;
(v)
signature; and
(vi)
any other unique physical or digital identifier related to the individual.
(7)
"Individual" means the same as that term is described in Section 
63G-2-103
.
(8)
(a)
"Mobile communication device" means any wireless communication device with 
Internet capability capable of displaying or providing a state-endorsed digital identity.
(b)
"Mobile communication device" includes a:
(i)
cellular telephone; or
(ii)
wireless tablet.
(9)
"Office" means the Office of Data Privacy created in Section 
63A-19-301
.
(10)
"Person" means the same as that term is defined in Section 
63G-2-103
.
(11)
"Personal data" means the same as that term is defined in Section 
63A-19-101
.
(12)
"Physical identity" means a physical record that an individual may use to prove the 
individual's identity issued by:
(a)
a governmental entity;
(b)
the equivalent of a governmental entity in another state;
(c)
the federal government; or
(d)
another country.
(13)
"State-endorsed digital identity" means an individual's digital identity that:
(a)
is controlled by the individual; and
(b)
has been officially recognized by the state.
(14)
"State-endorsed digital identity program" means a state initiative which is designed to 
develop methods, policies, and procedures to endorse an individual's digital identity.
(15)
"System" means the technological infrastructure, processes, and procedures used to 
create, store, manage, and validate a state-endorsed digital identity.
Section 2, Section 
63A-16-1202
 is enacted to read:
63A-16-1202
. State digital identity policy.
(1)
It is the policy of Utah that:
(a)
each individual has a unique identity;
(b)
the state does not establish an individual's identity;
(c)
the state may, in certain circumstances, recognize and endorse an individual's 
identity;
(d)
the state is obligated to respect an individual's privacy interest associated with the 
individual's identity;
(e)
the state is the only governmental entity that may endorse an individual's digital 
identity for the purpose of establishing a state-endorsed digital identity;
(f)
the state may only endorse an individual's digital identity if the state-endorsed digital 
identity program is expressly authorized by the Legislature;
(g)
an individual whose digital identity has been endorsed by the state is entitled to:
(i)
choose:
(A)
how the individual discloses the individual's state-endorsed digital identity;
(B)
to whom the individual discloses the individual's state-endorsed digital 
identity;
(C)
which elements of the individual's state-endorsed digital identity to disclose;
(D)
where the individual's state-endorsed digital identity is stored; and
(E)
whether to use a state-endorsed digital identity or physical identity to prove 
the individual's identity;
(ii)
allow a governmental entity or a person to use information related to the 
individual's use of the individual's state-endorsed digital identity for a purpose 
other than the primary purpose for which the governmental entity or person 
collected the information; and
(iii)
have a guardian obtain or use a state-endorsed digital identity on the individual's 
behalf;
(h)
a governmental entity or person that accepts a state-endorsed digital identity shall:
(i)
collect, use, and retain an individual's state-endorsed digital identity in a secure 
manner; and
(ii)
comply with the requirements of this part through technological means;
(i)
a governmental entity may not:
(i)
convey a material benefit upon an individual for using a state-endorsed digital 
identity instead of a physical identity; or
(ii)
withhold services or benefits from an individual if the individual uses a physical 
identity or is otherwise unable to use a state-endorsed digital identity; and
(j)
a governmental entity or a person may not require an individual to surrender the 
individual's mobile communication device to verify the individual's identity.
(2)
The state may not endorse an individual's digital identity unless:
(a)
the state has verified an individual's identity before endorsement;
(b)
the state-endorsed digital identity:
(i)
incorporates state-of-the-art safeguards for protecting the individual's identity;
(ii)
includes methods to establish authenticity;
(iii)
is easy for an individual to adopt and use; and
(iv)
is compatible with a wide variety of technological systems without sacrificing 
privacy or security;
(c)
the state provides clear information to an individual regarding how the individual 
may:
(i)
maintain and control the individual's state-endorsed digital identity;
(ii)
use the individual's state-endorsed digital identity;
(iii)
limit access to:
(A)
the individual's state-endorsed digital identity; and
(B)
any elements of the individual's identity disclosed by the state-endorsed digital 
identity; and
(iv)
obtain a new state-endorsed digital identity if the individual's state-endorsed 
digital identity is compromised;
(d)
the state ensures that when an individual uses a state-endorsed digital identity:
(i)
any record of the individual's use:
(A)
is only used for the primary purpose for which the individual disclosed the 
state-endorsed digital identity; and
(B)
is not disclosed, shared, or compared by the governmental entity or person 
receiving the state-endorsed digital identity; and
(ii)
the use is free from surveillance, visibility, tracking, or monitoring by any other 
governmental entity or person; and
(e)
the state-endorsed digital identity enables an individual to:
(i)
selectively disclose elements of the individual's identity; and
(ii)
verify that the individual's age satisfies an age requirement without revealing the 
individual's age or date of birth.
(3)
The state may only revoke or withdraw the state's endorsement of an individual's 
state-endorsed digital identity if:
(a)
the state-endorsed digital identity has been compromised;
(b)
the state's endorsement was:
(i)
issued in error; or
(ii)
based on fraudulent information; or
(c)
the individual requests that the state revoke or withdraw the endorsement of the 
individual's state-endorsed digital identity.
Section 3, Section 
63A-16-1203
 is enacted to read:
63A-16-1203
. Department duties.
(1)
The department shall:
(a)
explore ways in which the state may implement a state-endorsed digital identity 
program consistent with the state policy expressed in Section 
63A-16-1202
;
(b)
study and identify best practices regarding the use of a digital identity;
(c)
propose policies, procedures, standards, and technology that should be incorporated 
in the state-endorsed digital identity program;
(d)
examine how the state-endorsed digital identity program may be implemented in the 
most cost-effective manner possible using state resources that are already available; 
and
(e)
evaluate and make recommendations regarding any changes to existing statutes, 
rules, or policies that may be necessary to facilitate the creation of a state-endorsed 
digital identity program.
(2)
In performing the duties described in Subsection (1), the department shall consult with:
(a)
the chief information officer;
(b)
the chief privacy officer;
(c)
the Utah League of Cities and Towns;
(d)
the Utah Association of Counties; and
(e)
individuals who have relevant expertise, including representatives from:
(i)
governmental entities;
(ii)
other states; and
(iii)
the private sector.
(3)
The department shall report to the Public Utilities, Energy, and Technology Interim 
Committee regarding the duties described in Subsection (1) and recommendations for 
the implementation of a state-endorsed digital identity program on or before October 31 
of each year.
Section 4. 
Effective Date.
This bill takes effect on 
May 7, 2025
.
3-6-25 6:32 PM