Why legislation
Constitutional doctrine develops slowly and case by case, and courts are reluctant to redesign executive systems. Legislatures can act now, and they control the point where architecture is chosen: procurement. Model legislation translates the four duties into specific obligations, architectural requirements and remedies, including a private right of action so that enforcement does not depend on agency discretion.
Three acts, three layers
- Verifiable Identity and Digital Autonomy Act (VIDA) governs identity architecture: holder-controlled credentials, verification before collection, no phone-home, and a prohibition on government population golden records.
- Personal Data Trusteeship Act (PDTA) governs the relationship: the individual as Primary Information Trustee, government as Secondary Information Fiduciary, the four duties, per se and presumptively disloyal practices, and a private right of action.
- Government Algorithmic Accountability and AI Fiduciary Act (GAAFA) governs computational power: AI inherits governmental authority and never creates it, with explanation, contestability and human judgment where decisions are legally material.
Utah has started
Utah's SB 260 (2025) set principles for state-endorsed digital identity, including individual control, anti-surveillance protections and selective disclosure. SB 275 (2026), passed unanimously, created the State-Endorsed Digital Identity program, a digital identity bill of rights and the first statutory duty of loyalty for digital identity. These statutes incorporate elements of VIDA and PDTA; they are not full enactments of the model acts. See what Utah enacted and what the acts add.
Where this is developed
The legislative pathway is set out in Part III of Data Lakes and Part VI of the Chatrie article. Current act texts are on the legislators' page.