(1) Any record of a presentation of a state digital identity may only be processed by a digital wallet provider, a verifier, or a relying party:
(a) for the primary purpose for which the presentation was performed; or
(b) if required by law.
(2) Information provided by a holder, verifier, or relying party to a verifier or relying party in the course of a presentation may only be:
(a) processed for the primary purpose for which the holder disclosed the information; and
(b) used, retained, sold, or shared:
(i) following conspicuous notice to and express authorization by the holder; or
(ii) if required by law.