 All right, welcome to judiciary. We're going to be considering two bills today. First senate or senate files excuse me. First senate file 39 digital identity. A little bit of a new topic for the judiciary committee but I'm confident they can handle it. And senate file 19 public health emergencies immunity amendments. A little more in our wheelhouse. We're going to start with senate file 39 digital identity. This is a product of the select committee on blockchain financial technology and digital innovations. Have with us my co chair from the senate senate office and we are joined by former representative Tyler Linholm who was on this select committee. I believe the two of you are going to present this bill is that is that what we're going to do? Yes, Mr. Chairman, I'd be happy to start. Okay. And Mr. Chairman, I do have another meeting coming right up. So I will start and then I'll hand over to former representative Linholm. We also have online I believe Mr. Dazza Greenwood who was part of the working group that worked through the blockchain select committee to prepare this legislation. So Clarissa, do you have Mr. Greenwood in the waiting room? Mr. Chairman, I do and he has been admitted to the meeting. All right, you can turn on your camera, Mr. Greenwood. And then we'll just let the three of you present together and and see where it takes us. Thank you, Mr. Chairman. Mr. Chairman, senate file 39 digital identity. It's a short bill and relatively straightforward. We'll go through what it currently does. A tremendous amount of time actually went into getting it to this point and it serves as a foundation for what we hope to be a substantial amount of additional work. The concept here with a digital identity is the idea of trying to formulate your digital presence in a way that we can then assign rights to it. A lot of what this does you could probably think well we could probably already do that under statute and that is probably true but it's not clear in statute and it's not unambiguous. So the work of the blockchain select committee recognizes that a digital identity and a representation of yourself through online operations, internet, blockchain transactions, banking. We already do these kinds of things but it's a little bit ad hoc and we wanted to flesh it out and provide clarity because these types of transactions are going to be more and more powerful and more and more important moving forward. Other states and other countries have also grappled with concepts of privacy rights but they've done those on largely an ad hoc basis. So GDPR which governs privacy rights in Europe and the CCPA and later amendments are in advanced privacy rights constructs on a west coast state and we're taking a little bit of a different approach because of the work that we've done in the past with the blockchain technology and digital asset custodianship where we want to build up from the idea of a digital identity empower that and then ideally in the future hopefully next year come back and look at privacy rights and property rights as they relate and interact with your digital identity. A different approach to how other states and countries have done it but hopefully one that is a more substantial approach to build off of and again we spent a tremendous number of hours with a lot of great legal minds coming together to work on this draft and really just get to the definition phase so that's what we're going to see today is a definition and a minor empowerment of that definition. Walking through the legislation on to page two. Senator just go ahead to drive I think to drive that home. This this bill is simply a definition. Mr. Chairman yes it's two definitions or two definitions references to those two definitions and then a link to the uniform electronic transactions act effectively as a baseline empowerment of those definitions as we'll see. Go ahead. All right I'm actually going to strangely start if you will on page three the bottom of page three and this is just based on legislative construct that that's where the beginning ends up being which gets to the actual definitions which are put into statute in title eight which are general definitions that apply throughout the statute and you see as used in these statutes unless the legislature clearly specifies otherwise two new definitions which are on page four. Personal digital identity means the intangible digital representation of by and for a natural person over which he has principal authority and through which he intentionally communicates or acts so there's a lot loaded into that definition and that was the bulk of the work that we did in the off season and Mr. Greenwood who's present here can go into the thought behind each of the words and phrasing after I take off in a few minutes. Organizational digital identity is parallel language but we recognize that as a minimum as we move forward we're going to want things like businesses and organizational entities to have legal standing and we're going to want to imbue those with separate rights from what a person is going to have a natural person so we just set up the construct from the beginning organizational individual as that delineation and then theoretically in the future we'll empower them accordingly with privacy and property rights and you'll hear in public testimony some of the thoughts behind how we're looking to do that so we put that into title eight and now again traveling backwards a little bit to page two or bottom of page one onto page two now we're creating chapter 30 of title 40 the digital identity act which begins with definitions and these definitions are simply references to those general definitions that we put in title eight and then the only other thing this bill really does as you can see on page two onto page three is clone the language for the uniform electronic transactions act which is already in Wyoming statute from a few years ago to empower your digital identity and your organizational digital identity with parallel power and authority to what you have with your electronic signature through ueda so again not a magnificent step but sort of the first step to recognize explicitly that your digital identity is representative and authoritative of your actions and you can see in romanet one acts taken through a personal digital identity are attributable to a natural person if they were the act of the natural person the act of the natural person may be established in any manner including a showing of the efficacy of any security procedure applied to determine the natural person to which an electronic record or electronic signature or other act was attributable parallel language in romanet two for the organizational and then romanet three again is ueda language getting to the intent and context of the circumstances surrounding the creation or execution of the event and at this point Mr chairman that's what the bill does but it's a foundation that i want everyone to contemplate what we're looking through in a broader picture where we want you to be able to act to this authoritatively as we get into a blockchain realm that's going to be typically through public and private key exchanges where if you have for example a business registered through the state of wyoming that has an organizational digital identity and a public key present that can be used for transactions with any company around the world authoritatively you as an individual if you opt to have a digital representation of yourself through your digital identity can have a public key and you know your private key and you can authoritatively engage in transactions you can screen information at your desire there's a great use case that we kind of contemplate as we began this discussion when you go in and you're you're buying a six pack of some delicious IPA and you walk up and you want to prove your age to the person at the cash register what do you do you take out your driver's license you hand that to them they know where you live what your name is whether you're an organ donor all sorts of things that you don't necessarily want them to know because what you want them to know is a simple binary question are you 21 yes or no digital identity concepts are trying to empower the ability to select what information you share with whom when and there are a number of commercial products out there frameworks organizations that are moving towards this we're trying to be entirely technology neutral and build a legal construct that enables all of these technologies to start in Wyoming and take hold here there's a lot of enthusiasm in that industry in space but this doesn't pick any of those technologies it doesn't say you have to have a digital identity it just creates that baseline framework mr chairman that we wanted to make sure was there so that industry can come and work with us and i'll stop there mr chairman see if there's any questions but then get to representative lintel and mr greenwood and i will be leaving in about three minutes sure and senator just i like to take the example you gave and uh and uh add to it a little bit because the example i like is my daughter who's purchasing a rated r movie at the supermarket and it requires her identification and the checker at the stand is a registered sex offender and when she provides her right when my daughter provides her id to that gentleman he uh he knows her address and uh when that's a completely unnecessary two-year point that we reach a place where we can answer and prove only the as you call it the binary question are are you of the age necessary all the all the other information doesn't matter um question senator what did you do to this bill to turn it blue mr chairman we had a number of meetings among the working group members after we first drafted the bill that came to the senate uh but the only thing that's changed is on page four when you look at the definitions uh on lines three and then mirrored below on 12 the original definition we had was over which he has dominion and through which he intentionally communicates or acts uh we were kind of uncomfortable with the word dominion and we spent some trying to trying to come up with a better term for what we were looking for sovereignty is the word we want to use sovereignty has so much baggage right so we couldn't use that but it's like the perfect word with tremendous baggage elsewhere in statute so we punted on it we came up with principal authority which didn't seem to contradict or overlap any other concepts got the point across principal authority means that you're the initiator of the authority effectively you've got that primary uh intrinsic authority and so we decided that was a better two-word phrase to capture what we're looking for than dominion and that's the only change twice sometimes these meetings are blurred to me but i feel like i may have spent eight hours discussing sovereignty yes this bill to only see it not in the bill that may be accurate and mr chairman my apologies but i have to run to another meeting you're in good hands with some incredible people that we have here and uh look forward to chatting with you both this later thank you all thank you senator mr linholm hey mr chairman good to see you yeah likewise uh mr chairman and uh committee members this piece of legislation comes from i know it seems like a really super simple bill and realistically what we what you're looking at really is a simplified version but the reality behind this piece of legislation is it comes from a monster amount of work trying to figure out this digital identity piece um and and the reason mr chairman on why i say there's so much work put in and yet this is fairly simple is because this is this is a big dog this is a monster this could be one of those next big things for the state of wyoming and i'm not talking about uh buying a buying a couple cans of booze or or uh rated our movie or something like that i i take a very different stance on this and why i think it could be a a bigger deal and it has to do with um online accounts and it has to do with when you're signing up for a bank account or something like that the federal government mandates that you do uh something called bsa standards which stands for the banking secrecy act that was first passed and i think it was 71 1971 mr chairman and was amended in the 2001 patriot act um all of which came well before where we are currently in technology with online banking and these digital asset exchanges and these community banks even having a um the ability to provide that uh that opportunity for you to cash checks online and so we're faced with kind of some old world regulation and how does the state of wyoming adapt to that um to allow allow this to happen because currently right now if you open up a online account i i don't know mr chairman if any of your members of your committee or yourself have ever opened on an online account for a banking type institution but we've got all these kind of every every outfit out there has their different kind of rules set up in place on how they verify your identity um mr chairman they've got to do what's called know your customer anti-money laundering standards so they've got to complete that that process and how do you do that online well different outfits do it in different ways one outfit i'll have you hold up your driver's license in front of your face with a newspaper from the from the day you're taking the uh the picture uh proving that it is actually you and uh then you got to scan your identity and all all of these different aspects trying to conform 2001 technology into 1970s and 2001 technology 2001 doesn't seem that long ago but folks i joined the u.s military in 2001 and that was 20 years ago so it it has been a little while and so for me that's why i'm excited about this legislation you'll notice um it it does go into title 40 the the new language does right there on page page one goes into title 40 and that's your trade and commerce uh statute that's your trade and commerce title and then it creates a new chapter um and that's chapter 30 digital identity act and so mr chairman that's creating essentially a placeholder for hopefully one day we can figure out that loophole and kyc standards um where we can allow these these little community banks uh like my community bank sonat state bank and these other institutions that exist in the state of Wyoming to be able to grow outside of their little communities and maybe do online banking in a way that no other jurisdiction can and that's what this is about is allowing our our little community banks our little little businesses in the state of Wyoming to grow outside of our border and expand their businesses and new businesses to come in and i think that's really where the merit of this of this legislation stands as as uh as senator rothas said or chairman rothas of the select blockchain committee um it does create that foundation which i think is important um we could not figure out how to uh pardon my language mr chairman how to bastardize the banking secrecy act um and that's still a work in progress i do know that there is some interest um from some us senators in the regards to fixing the banking secrecy act um to allow the state of Wyoming more flexibility in this regard and uh but i'm not speaking on behalf of that individual i'm speaking on behalf of myself so with that i'll stand for any questions mr chairman representative yin thank you mr chairman mr linholm i'm just curious where you are testifying from because you did not announce that at the beginning thank you mr chairman where are you testifying from i'm thank you mr chairman i'm testifying from my kitchen table and uh i'm usually in my basement but i've got too many political signs down there so i figured i better move my laptop upstairs away from said political signs so mr linholm when i want to open a bank account i just text my banker and say i need to open an account or i want to i want to get this loan or wherever it is i just text him so what how does how does that world change for me in Wyoming or does it really or are we really talking about bringing in um some i i guess some growth some outside Wyoming it's it's outside the world that's banking is that what you're talking about mr chairman i'm talking about both things so when you text your banker that's an existing relationship that you already have and that banker has already established know your customer and anti money laundering standards on you and they've got proof of that they can share those regular that that proof of concept in inside house they can't share that with another institution mr chairman if you were to contact another banking institution that you didn't already have an existing relationship with you would have to you would have to prove uh prove that know your customer and anti money laundering standards all over again fortunately most of us in the state of Wyoming i i suspect uh all of us in fact have had a bank account for quite some time and so it's really not that kind of a wild concept until you go to online until you open up a new a new account online and then all of a sudden it's it's it's pretty burdensome in that regard um but this this putting in that this in statute so that provides that opportunity where hopefully something um would shake shake loose as far as our regulatory entities the division of banking in the state of Wyoming those types of entities where they would be able to use utilize this type of legislation possibly um but also mr chairman i think this this is uh just like a lot of the piece of legislation that we've passed in regards to icos and all those things this puts a flag in the ground and does something in the state of Wyoming that no other jurisdiction has even contemplated and provides the most important thing um and i know the the legal minds on your committee such as uh representative oakley and yourself and i'm sure i'm missing some attorneys that i probably don't know um representative kregel but he's not he's not here now representative kregel is one of my uh one of my one of my favorite new legislators and then representative yen would give him an honorary jurist doctor that's handy mr chairman i don't know why i didn't get one of those but i but i think that legal precedence aspect mr chairman is is so important and that that's why Wyoming has seen success that's why iohk is domiciled in the state of Wyoming that's why kraken's moving here and the list goes on on these large institutions because legal precedence means the world to larger institutions and so yeah i guess that's a long way of answering your question mr chairman i finally saw a hand to my left and you're just eating chips maybe that's what maybe that's what it was i i had the barbecue ones earlier i'm good questions for mr lindholm oh it was you vice chairman wash it thank you as chairman former representative lindholm good to see you again uh as we were talking and listening to the good senator present the bill and he was talking about this being foundational to eventually establishing uh property rights and privacy rights associated with this digital identity uh the first thought to pop into my mind is are there any responsibilities to go along with those rights well these types of digital identity also carry with them some social or civil responsibilities mr lindholm yeah thank you mr chairman and to mr vice chairman um great to see you sir um i you know honestly when it comes to digital identity or this this type of legislation this this law doesn't exempt anybody from identity theft or any other type of criminal statutes um that are in existence um but there is a right and responsibility throughout the throughout the legislation as defined um specifically mr chairman um under on page three under roman net number three i think an important part of this piece of legislation um is starting on line 10 and that that is shall be determined from the context and surrounding circumstances at the time of its creation execution or adoption so mr chairman to you mr vice chairman uh to me um that essentially means that uh that that proof of digital identity for the execution of whatever type of transaction because this is only for transactional type aspects in that regard that would mean it's only for that one execution per time that you actually utilize that digital identity so it's not a it's not it's definitely not written as a cart block any other questions for mr lindholm all right got off pretty easy i think thanks mr chairman i was it i was expecting you to mess with me a little bit so i'm glad to get out with my my hide still attached i have uh unfortunately so many questions about this bill that i i just uh i want to follow up with the email on them to you all right mr greenwood thank you thank you very much um it's an honor to to be here uh my name is dazza greenwood i run law dot mit dot edu that is a um an initiative at mit that is focused on applying engineering to law um and uh we call it computational law in particular and um i run cibix dot com which is my um my private company and uh in in all of my endeavors since since the 90s when i was a government lawyer um the same issue has been coming up which is the need to solve if you will for for digital identity it's been really a missing piece um and and and and it all starts i think we're getting the right legal framework in place but but we can still see today when we think of digital identity uh representative lindholm uh mentioned accounts and this really being about like an account that we use uh the accounts that we have from google uh from our employers our patient portals government ids is social media of course uh they're all these fractions of identity and the one thing that they all have in common is that they're issued by somebody else they're in a sense owned and controlled primarily by some other entity they can set the terms turn them on or off change them um it's like a privilege in a sense um at best and and yet i think it's just plainly obvious now in 2021 the world is going digital um you know the activities we do in commerce and in and with government and and in health care and education every every part of our life and the economy and society increasingly is happening like the authoritative activities happening online but where is the space for our identity um the the one that arises from us um that's almost implied in most legal frameworks um that preceded the digital age um and we did a very careful analysis of wyoming statutes and the constitution and the the rules leading up from uh being a territory to a state many places where individuals were identified uh and there was a lot implied in in the individual uh and in the person and in the citizen and the resident um they're the ones that needed to consent to be governed they're the ones that um that from whom authority arose for them to conduct their affairs um they they were the uh well to to use the word we used to use they had dominion in a sense over their identity um and that was a building block and it made perfect sense that's all been confused somewhat based on the way architectures have evolved online and so there's some of this is just having legally we there's something missing that that is now solved in this legislation which is the first building block which is itself a definition just of there there describing a person's individual identity um the one that is of by and for them through which um they have principal authority principal p al um like in an um agency law the authority arises from them um and and uh and you know after much drafting and back and forth in many cycles of of feedback um from broader communities uh including at mit where we've circulated this in classes and in talks and sought to get a lot of feedback on this and uh and in other circles as well trade associations we think we've got it and part of the reason i i'm so such a fan of this definition is precisely because it is so simple like we really couldn't have made it more rudimentary and it's of the same size as the as the as the other definitions in in um in um in the chapter with the definitions that apply um across wyoming law you know they're all like you know 10 to 30 words and then we think that's the right that was that's what we were shooting for and we i think we felt that if if we couldn't explain this in that few words we we probably it probably wasn't ready for a definition that would serve the role as being to be a building block that could be referenced by and ultimately support and reflected in in other parts of wyoming law the first other part has been said many times is is uh uniform electronic transactions act and the rules of attribution of acts to people online and that that does get us toward the accountability or the responsibility that was being asked about a moment ago so one is um responsible for for the acts that they take through their digital identity um and i think looking ahead uh if this definition is acceptable and and is adopted and uh enacted in future sessions um some other areas of law that seem like they may be good fits may be identity theft and and possibly section um 63902 uh the unlawful impersonation through electronic means you know we we think the identity that is a person's identity should not be subject to uh you know a fraudulent or criminal impersonation uh so like that would be a perfect extrapolation of this you can imagine privacy but also civic civic uh and commercial um uh uh legal frameworks also uh benefiting from this so that we can start to in a in a recent way um adopt a sense of individual identity uh you know through the law and so with that i want to um i think pause my remarks and just say that i am very much in favor of this legislative definition and of this measure and and and i i hope the committee if if you believe it is of value and timely as well will seek to adopt it mr greenwood how many states statutorily define uh personal or digital identity so i i think that this formulation might be the first of its kind um there are many examples of digital identity in different ways being defined in statute uh i i mentioned identity theft for example and personally identifiable information and breach notification and digital identity if you do just like a westlaw or lexus search or something comes up all over the place that's partly why we added a word here to get to which facet of identity are we talking about not the identity that is coming from others which people certainly have rights and interests in and can cause them harm and and benefit but we added personal digital identity um to distinguish this uh and limit it to the building block which which um which is the one that sources from the person or sometimes colloquially people say self sovereign or self sourced identity um and so this is something that's been talked about a lot in um digital identity circles uh it was the center of something called n-stick national strategy for trusted identities in cyberspace which was a um a public private partnership that nist and um gsa and homeland security ran with a bunch of industry groups where they were attempting to come up with private sector led standards for this type of identity that comes from people and that can be relied upon by um by others uh and so there's been a a push towards something like this but this is the the first um of its type to be articulated in in a clear and I think very valid manner in statute and honestly we the people who have been barking up this tree we've always felt that statute was the right place to at least define the terms and allow others to build build toward those terms and and so we we hope that you will be the first to adopt this and part of the conversation the committee uh did involve the um hope and maybe expectation that um this definition might just have legs and we might in fact see this adopted in other jurisdictions uh to follow because it does feel uh very well known need is the same true for organizational digital identity yes well I'd have to do some more checking there the most important area that is reflected in various layers of law I'd say is the legal entity identifier lei uh which is more from banking and finance and like FinCEN uh financial crimes enforcement kind of angle and it's basically they're seeking to have a unique identifier for each legal entity as opposed to the tangled web we have of so many identifiers right now and that makes it difficult for you know commerce and regulation and enforcement investing and analysis and all sorts of stuff um but that's not that's an identifier that's going to come from a registry if it if it matures at all there isn't an actual legal definition of the entity and just to uh of the digital definition of the digital legal identity of the company and just to put it just to put that in context for a moment uh just a couple of days ago is working with uh with a startup who is seeking to build apps and services for companies to um take information from and connect information to their google business identity and so when you look at google maps you'll see lots of companies and you'll see them on the map and you can click on them and you can see their store hours their contact their website they're filling a gap here that I would think in the first instance is is that of state government in the united states to to fulfill the the government the state government through the secretary of state gives rise to or is the authoritative source of when a business is born by incorporation or LLC formation and and there you can't go to a registry but again there's no there there and so we have companies like google and of course dunham brad street and many others that are filling the gap digitally but they can only go so far at some point at the bottom of the stack we need an authoritative identity and a profile that that that entities can act through and it'll just end by saying if you think of things like phishing attacks when people get an email purportedly from their bank or from some company and they start to do things um how can they know whether this is the company it purports to be again the the ambiguity here and the that's being exploited or just causing confusion comes partly because we don't have an authoritative organizational digital identity and having a legal definition we think is a real good start and ultimately things like the apis and other reforms happening in wyoming secretary of states area um can adopt that and can extend uh can extend that into other areas of law and practice questions for mr greenwood mr greenwood the moment i realized i existed is when i had a wikipedia page online that's my digital identity all right thanks mr greenwood appreciate you we'll see him over this i'm sure we'll see this uh interim thank you