17.3 Private C-accounts

A private C-account preserves a limited domain of private consumption analogous to physical cash. The account owner and transfers between the private C-account and the owner's other accounts are known. The CBPS temporarily records an external payment from a private C-account while distributed nodes durably incorporate it, but must irreversibly purge the link to the owner, private C-account, funding transfers, and other external payments from private C-accounts once the transaction lies before the certified retention vector time. In normal operation this is expected to occur within seconds. The recipient learns that it received a valid payment but the payment system does not disclose the payer's identity. Where a purchase independently requires identity, such as for delivery or registration of ownership, using a private C-account does not conceal information supplied outside the payment system.

The owner may keep an optional local history or receipts on a device under their exclusive control. That record is not part of the CBPS, is not authoritative, and may be deleted by the owner. The local history itself must never be transmitted to or stored by the Central Bank. The CBPS may provide the information needed to use the private C-account, including its available value, pending operations, and anonymous refund credentials. Once the retention vector permits the underlying transaction records to be purged, neither the owner nor another Person can request a private C-account transaction history from the Central Bank because it no longer possesses the information needed to reconstruct one.

Before the protected information is purged, access to it for a criminal investigation requires a warrant. After it is purged, no authority can compel the Central Bank to produce a private C-account purchase history that the system no longer retains. A warrant may still allow investigators to examine the owner's identified account records, the recipient's remaining R-account or G-account records, and evidence outside the CBPS. The enduring protection therefore rests on deletion rather than only on a rule restricting access to centrally stored information.

Privacy does not displace consumption tax or tax choice. Payments from a private C-account have the same tax treatment as payments from a standard C-account. While processing the payment, the CBPS allocates a Citizen's tax according to the choice on their C-account. The identifying link is then purged when permitted by the certified retention vector time. Tax paid by a non-citizen is allocated by the water filling algorithm. Public accounts may report aggregate tax receipts and allocations but not information from which a purged individual payment history could be reconstructed.

Standard and private C-accounts have the same transfer and tax rules. The owner may move value between a private C-account and their other accounts under the ordinary internal-transfer rules. The difference is information handling: an external payment from a standard C-account retains the normal identified record, while an external payment from a private C-account to an R-account or G-account receives the privacy and purging protections described here.