Utah Code § 63A-20-702: Processing restrictions.

(1) Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party:

(a) for the primary purpose for which the presentation was performed; or

(b) if required by law.

(2) Information provided by a holder, verifier, or relying party to a verifier or relying party in the course of a presentation may only be:

(a) processed for the primary purpose for which the holder disclosed the information; and

(b) used, retained, sold, or shared:

(i) following conspicuous notice to and express authorization by the holder; or

(ii) if required by law.