Utah's Chief Privacy Officer unveils SEDI, a state-endorsed digital identity model built on individual control, at a UVU hackathon where a Provo team builds AI health-record agents on the same framework.
Orem, Utah — June 20, 2026
Christopher Bramwell stayed on the floor of Utah Valley University's HITLAB Healthcare Innovation World Cup and Hackathon until 9:30 p.m. the night before final pitches, fielding questions from teams who'd been building since the day before. Bramwell is Utah's Chief Privacy Officer and Director of the Office of Data Privacy, and he wasn't there for a photo op.
"It would be the hackathon, specifically the two bounties we put forward are related to state endorsed digital identity and AI agents, and then another one on AI orchestration to create data governance models," Bramwell said. "So that's why we're here."
The Other Bounty
The data governance half of Bramwell's pitch is the quieter one, but it gets at something oddly relatable: even the people the rules are supposed to protect usually have no idea what those rules are.
"If you wanted to say, 'Hey, what are the rules around my student data at UVU?' You probably don't know, you know FERPA, but you don't know in the weeds, like, what's this classification? How long do they keep it?" Bramwell said. "We've been on the back end working with UVU on white papers of a new governance model approach that you can standardize across government. Counties, cities, towns all essentially do the same thing, so why do you have unequal data rights under the law that should be following similar models?"
Identity, Done Wrong
Data governance is one half of Bramwell's job. Identity is the other, and it's clearly the half he's most consumed by.
"SEDI is a big initiative out of our department as well," Bramwell said. "On the privacy side, that's 50% of our time right now is how to empower individuals to have a form of digital identity that they control."
Bramwell did not mince words about the current state of digital identity. Right now, proving who you are online almost always means going through someone else first.
"Even right now, if you go to irs.gov and you want to file your taxes, you have to sign up for a third party private company account to create a digital identity through their platform, and their terms and conditions say they can terminate it at any time they want," Bramwell said. "You're not in control, and we have fundamentally done identity wrong."
"If you can't one-on-one with those people prove who you are, and you have to go through an intermediary, that's wrong," Bramwell said. "Any model we do has to allow two people, when they engage online, to prove and verify they are who they say they are, with no surveillance, no tracking by either government or corporation."
That belief shaped Utah's State-Endorsed Digital Identity (SEDI) program established by Senate Bill 275. Sponsored by Sen. Kirk Cullimore, the bill passed the Senate without a single no vote on Feb. 24, 2026, passed the House without a single no vote on March 4, and was signed into law on March 25. Like most bills from Utah's 2026 General Session, it took legal effect on May 6, 2026.
Endorsed, Not Owned
The core distinction, Bramwell said, is that the state verifies a person's identity and endorses it — it does not create or own it. SpruceID, an identity infrastructure firm tracking Utah's framework, puts the constitutional premise plainly: identity belongs to the person, not the state, and government's role is limited to verifying and endorsing it, the way a notary vouches for a signature rather than owning it outright.
"Utah has the only comprehensive digital identity legislation and law," Bramwell said. "In legislation, there's a digital identity bill of rights, so, like, these are the foundational rights that we're kind of translating from the constitutional rights to now tech."
He reached for a familiar comparison to explain why endorsement carries weight.
"Just like with money, which is backed by the government, your identity now you can say, 'Yep, I am me, and the state has verified it,' and because of that, the private and public sector accept it," Bramwell said.
That ordering of priorities, rights before convenience, is deliberate.
"Our part of our concern with the current tech approach is usually they focus on efficiency and interoperability before everything else," Bramwell said. "Very rarely, if ever, do you see anybody say, 'Hey, what are people's individual rights?' and let that define our first requirements for a technology system. We will not compromise your individual rights for any lesser values, like interoperability or efficiency."
The ACLU has called Utah's law the best effort any state has made to reconcile digital identity with civil liberties, pointing to its "duty of loyalty" provision requiring every entity that accepts a SEDI credential — not just the state — to use personal data only for disclosed purposes.
Control of the underlying cryptographic keys is the mechanism behind that promise. We put a comparison to Bramwell directly: the system works something like a World War II Enigma machine, which used a fresh cipher setting for every message so one compromise didn't cascade. He agreed the comparison held up.
"That's a good example, because whoever controls the key controls the data," Bramwell said. "If you don't control your own key, that means somebody else is in control. Our sole focus has been to give you control, but assume compromise, because when it is compromised or broken, how do you rotate to the next key?"
That key-rotation design also changes what happens after a data breach, Bramwell said.
"When you have a SEDI credential, if somebody were to compromise that, the protocol facilitates the ability to detect that somebody's presenting that that's not you, and then it rotates to the next cryptographic key. That identity is worthless. You now have a form of identity that people cannot impersonate you with," Bramwell said.
He argued the market's current trust in static documents, like a scanned ID or a utility bill, is already obsolete in an AI age.
"What needs to happen is the market needs to adjust to not accept these inferior forms of proof that anybody or an AI can easily create some of these documents based off of the breach data that they're trained on," Bramwell said.
Good for UVU, Too
The choice of venue wasn't incidental. UVU's Kahlert Applied AI Institute co-hosted the event with HITLAB, a New York City-based health innovation research organization, inside the university's Smith Engineering Building. More than 1,200 applicants from around the world competed for a share of a $96,000 prize pool, with representatives from Dell, Salesforce, Google, Motorola, and Goldman Sachs in the room watching teams pitch.
Justin Jones, Executive Director of the Gary R. Herbert Institute for Public Policy, framed the long-term payoff in terms of the students themselves, not the university's brand.
"I think that ten years from now, we're going to have a group of students leaving UVU and going out into the world and into the workforce that understand how much policy drives and can either work or incentivize the private sector in a positive way," Jones said.
Beyond Utah
Bramwell does not see SEDI staying a Utah-only project for long.
"Our intent with this is not just to be the Utah model, it's to create such a good model that it would become the de facto American approach to digital identity, because there is no national policy right now," Bramwell said.
The bill's bipartisan path through the Legislature, he said, is evidence the model can travel: "SEDI was the first approach where an actual full legislature deliberated. We spent two years on it, and then they passed unanimously with support from both sides of the aisle."
Utah is now courting other states directly, building toward a multi-state consortium and a National Conference of State Legislatures presentation this summer. Some of that outreach is starting from zero, even inside the federal government, where Bramwell said the effort is "news to some of these people... they didn't know people even cared."
Utah has already hosted two summits drawing roughly a dozen states each, with a third planned for mid-November, and expects to issue its first SEDI credentials within about 12 months of the hackathon.
"For those states that go this direction, their citizens are going to love them, and those states who don't go this direction, citizens are going to notice, and people will choose to live and work in states where they have more freedom," Bramwell said.
Not a One-Man Show
For all the time he's spent as the public face of SEDI, Bramwell was quick to deflect sole credit. The same national ACLU that has since published commentary on Utah's law was, by his account, in the room helping shape it for years before it passed.
"There's a core team at the state that's been kind of working on the periphery of this for years... a huge set of stakeholders of identity experts in the private sector, citizen groups, national ACLU has been heavily involved," Bramwell said. "I'm lucky enough to be kind of a policy spokesperson for it, but everything I'm saying represents dozens and dozens of people who have participated."
The Long Game
Bramwell's office has used this approach before, partnering with UVU's Gary R. Herbert Institute for Public Policy to research problem areas and build the academic basis for legal recommendations.
One Herbert Institute paper uncovered a problem that was almost too on the nose: government transparency rules accidentally exposing the very people they were meant to protect.
"If you have a veteran tax abatement, and it's because you're 100% blind, that was public information," Bramwell said. "Now people can use that to target you for crimes, and that has happened in other states."
The twist, he said, was that nobody needed to break in to get it: "Not even a hacker, if the county makes it public, it's public."
The research that surfaced the problem was done by two of his office's interns, becoming the basis for a new law, the same "unequal data rights" pattern Bramwell had flagged at the start of the hackathon, just playing out with veterans' records instead of student records.
When asked what he wished more people understood, Bramwell didn't talk about technology at all.
"A lot of people feel uncomfortable with just the current state attack. They feel like there's like the sense of something seems a little off, and they don't quite know how to articulate," Bramwell said. "They even don't even think they can get privacy back."
He reached for an unusual comparison to make his case: the unregulated excesses of the Industrial Revolution.
"We did some really bad things in the name of capitalism and industrialism, which had child labor... People were dying and losing limbs, and it's because this was so new to America," Bramwell said. "Tech, the last three years, has been such rapid change that we're just now seeing and recognizing that we may not quite like what this technology has done. But I think people need to realize there is a point where you can have privacy again."
It's the same long view he applied when asked what's really at stake.
"We've had a lot of data breached about us, but our kids and grandkids haven't, so the world we create needs to ensure that they can have a better world than we had. Especially when it comes to AI and technology, we need to begin building it in a way that benefits individuals," Bramwell said.
The interview ended mid-thought, much like his days at the hackathon seemed to go: Bramwell turned to wave over two student co-coaches before he could finish his sentence.
A related study from UVU's Emerging Tech Policy Lab, released the same day, and covered by TechBuzz, found that nobody can reliably tell a real video from an AI-generated one — the same erosion of trust Bramwell pointed to in warning that "an AI can easily create some of these documents based off of the breach data that they're trained on."
TechBuzz will continue following this story, including Utah's rollout of SEDI credentials, expected to begin within the next 12 months.