63A-20-702. Processing restrictions.
(1) Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party: for the primary purpose for which the presentation was performed; or if required by law.
(2) Information provided by a holder, verifier, or relying party to a verifier or relying party in the course of a presentation may only be: processed for the primary purpose for which the holder disclosed the information; and used, retained, sold, or shared: following conspicuous notice to and express authorization by the holder; or if required by law.