When people think about blockchain innovation, they often think about startups, developers, and new technologies. Just as important, though, are the policymakers working behind the scenes to build the frameworks that will shape how these technologies are used in the real world.
Chris Bramwell serves as Utah’s Chief Privacy Officer and Director of the Office of Data Privacy, where he helps guide the state’s approach to privacy, data governance, digital identity, and emerging technologies. His work sits at the intersection of public policy, personal privacy, and innovation, with Utah becoming one of the first states to pursue a comprehensive vision for government data privacy and state-endorsed digital identity.
In this month’s Builder Spotlight, we sat down with Chris to discuss Utah’s privacy strategy, the future of digital identity, the role blockchain and cryptography can play in building trust online, and why he believes Utah is uniquely positioned to lead these conversations.
UBC: Tell us about your background and how you became Utah’s Chief Privacy Officer.
Chris Bramwell: My background is in public policy, privacy, and security. I earned my undergraduate degree in political science from BYU and later completed a master’s degree in information assurance through a National Science Foundation program at Idaho State University. Information assurance focuses on the privacy and security of data.
After graduate school, I worked for Homeland Security and then joined the State of Utah following the state’s 2012 data breach. I’ve been with the state ever since. In 2021, the legislature passed a law that expanded the role of the government operations privacy officer. My job was to assess what I believed were the biggest risks to personal privacy within government. Through that work, we helped develop what became the Government Data Privacy Act. The legislature also created the Office of Data Privacy and established my role as Utah’s Chief Privacy Officer.
Today, part of my responsibility is maintaining the state’s privacy strategy and helping answer questions such as: How do we approach privacy over the next decade? What legislative changes are needed? What initiatives should government prioritize? We also focus on broader data governance, including how government manages, secures, protects, and uses data. One interesting aspect of Utah’s approach is that, with the Government Data Privacy Act, Utah became the only state with a comprehensive government data privacy law. Many states are working on privacy issues, but few have a clear legal framework that provides a vision and direction. Having that framework allows us to focus on implementation and modernization over the coming decade.
UBC: How do you view the current approach to privacy in the private sector?
Chris Bramwell: Government and private-sector privacy are very different conversations. Utah has both the Government Data Privacy Act and a consumer privacy law, but most states still do not have comprehensive privacy legislation, and there is no federal privacy law. At a high level, much of the private sector has built privacy programs around notice and consent. Companies provide notices, terms, and conditions, and individuals consent to them. Many leading academics now view that model as broken because people will consent to almost anything, often without understanding the privacy implications or potential harms.
In Utah, we’ve been exploring a different concept known as the “duty of loyalty.” This idea was proposed by Neil Richards and Woodrow Hartzog and focuses on preventing data from being used against an individual’s best interests. The principle is straightforward: certain protections should exist regardless of what someone agrees to in a terms-of-service document. Personal data should not be used in ways that harm the individual. That creates a new foundation for protecting people’s interests in relation to their data. We have not yet incorporated this concept into consumer privacy law, but it is included within Utah’s state-endorsed digital identity legislation. Any data derived from a person’s digital identity is subject to that duty of loyalty.
UBC: What inspired Utah’s approach to digital identity?
Chris Bramwell: This approach is already reflected in Utah law, and our goal is to make it a national model. We are actively working with other states, federal agencies, regulators, and private-sector organizations to create a multi-state consortium around this approach. At its core, the idea is based on trust. In a free-market transaction, two parties choose to engage with one another. Today, people often agree to terms and conditions that are not necessarily in their best interests. At the same time, AI and synthetic content are making it increasingly difficult to determine what is real and who is actually on the other side of a transaction.
Our goal is to create trusted digital identity systems that allow people to prove who they are online and verify the identity of those they are interacting with. Any personal data derived from that identity would then be protected by the duty of loyalty. The broader vision is to give individuals more control over their identity and personal information while creating a trusted framework for digital interactions in the future.
UBC: Who is involved in this effort?
Chris Bramwell: A wide range of organizations have participated. Private-sector stakeholders have included organizations such as the Utah Blockchain Coalition, Cardano, and the Digital Chamber. We’ve also engaged with groups such as the ACLU and many other stakeholders. On the government side, we’ve hosted multiple multi-state consortium meetings with more than a dozen states participating. We are now working toward a formal consortium agreement among governors who share an interest in advancing this digital identity model.
UBC: What role does blockchain technology play in this vision?
Chris Bramwell: There are several components to our approach, including blockchain, cryptography, and distributed ledger technologies. In our state-endorsed digital identity model, individuals control their own cryptographic identifiers. Our view is that whoever controls the private keys controls the identity.
We’re also using decentralized ledger concepts. Rather than relying on a single centralized system, individuals maintain control over information related to their identities and transactions. The goal is to empower every individual with a decentralized identity built on keys they control and supported by distributed ledger technologies. Importantly, the identity itself would not necessarily live on a blockchain. Instead, this approach enables trusted digital transactions that could later be recorded on blockchains or other permanent record systems.
For example, one use case we’re exploring is real property transfers. A person could use a state-endorsed digital identity to digitally sign a property transaction, while the resulting record could be stored in a blockchain-based system. The individual maintains control over their identity while benefiting from secure, verifiable records.
UBC: How does this approach give individuals more control over their data?
Chris Bramwell: A core objective is shifting control to the individual. We do not want identities tied to a single blockchain, ecosystem, or proprietary platform. Individuals should be able to move their identities wherever they choose because they control the keys.
We’re also working to give people greater control over important records and credentials. That includes items such as medical records, immunization records, education records, transcripts, and birth certificates. The goal is for individuals to possess verifiable versions of these records that they can use across both the public and private sectors. This becomes increasingly important in an AI-driven world. Even if someone has access to your personal information, they should not be able to impersonate you because they would not possess the cryptographic proof associated with a verifiable credential.
UBC: What are some of the real-world harms created by today’s data environment?
Chris Bramwell: Many people sense that problems exist but struggle to identify specific harms. One example is sextortion, which is one of the fastest-growing crimes affecting young men in the United States. In many cases, someone pretending to be a peer sends messages and images to a young person. Once trust is established, the victim is manipulated into sharing personal content and is then threatened with exposure unless money is paid.
At its core, this is an identity, impersonation, and fraud problem. The victim has no reliable way to verify who is on the other side of the interaction. Property fraud is another example. Criminals can impersonate property owners, submit fraudulent records, and transfer ownership of real estate. In some cases, the fraud is not discovered until months later. We also see identity-based fraud in areas such as unemployment insurance, where losses have reached tens of billions of dollars nationally.
Beyond financial harm, there are information harms. Many online platforms use personal data to profile individuals and predict behavior. Those systems can be optimized to maximize engagement, often by promoting content that provokes strong emotional reactions. Our view is that people should have greater control over their identities and data, and that organizations should not be allowed to use personal information in ways that run contrary to an individual’s best interests.
UBC: What makes Utah a good place to build and innovate?
Chris Bramwell: I grew up in Delaware, but I have deep family roots in Utah. After high school, I transferred from school back east to BYU and have remained in Utah and the Mountain West ever since. On a personal level, Utah is a great place to raise a family. The culture and values have been important to me.
From a policy perspective, Utah is unique because of its focus on solving problems and building thoughtful public policy. There is a willingness here to bring people together, work through difficult issues, and pursue long-term visions. I honestly don’t think we could have accomplished what we’re doing in another state. Utah’s leadership and collaborative approach have been a major part of why these efforts have been successful Our hope is that we can build the model here first and then help other states follow through the consortium we’re creating.