Utah has enacted a first-of-its-kind digital identity law that includes a “duty of loyalty,” requiring companies and government actors to act in the best interests of individuals when handling their data. In addition to the duty of loyalty, the framework also allows people holding a digital ID to selectively reveal some rather than all of their information, prevents government tracking of ID usage, and otherwise limits the unnecessary collection of personal data.
The law reflects a growing national shift toward stronger data governance and builds on ideas advanced by the Cordell Institute at WashU Law. The Institute has spent several years developing the concept of “data loyalty,” which requires that entities managing personal data should be bound by obligations similar to fiduciary duties, and not betray the vulnerable people whose data they collect and process.
That approach was notably articulated by Neil Richards, Koch Distinguished Professor in Law and Co-Director at The Cordell Institute, and Cordell Institute Faculty Fellow Woodrow Hartzog in their 2021 law review article, “A Duty of Loyalty for Privacy Law.” In that article, Richards and Hartzog argued that “a duty of loyalty framed in terms of the best interests of digital consumers is coherent and desirable and should become a basic element of US data privacy law,” and argued that its adoption would be “a revolution in data privacy law.”
“We’re delighted that Utah has passed a consumer-protective digital law reflecting the duty of loyalty we’ve been developing at the Cordell Institute for several years now,” said Professor Richards. “Duties of data loyalty have the potential to really protect consumers in ways that many of our current legal frameworks fail to do by avoiding fictions of implied consent and making sure that vulnerable digital consumers and their data are protected from mischief no matter what they choose.”
Utah’s law marks a significant step in embodying that theory into the law, showing how the important work going on at the Cordell Institute is shaping the evolving landscape of privacy law in ways that protect people and their data.
Read the full ACLU article here: https://www.aclu.org/news/privacy-technology/utah-digital-id-law
