Data Handling: Dependencies between Authorizations and Obligations

Authorizations and obligations are keystones of data handling. On one hand there are ambiguous links between authorization and obligations. On the other hand a clear separation between both concepts is necessary to improve readability and to avoid inconsistencies. This position paper focuses on authorizations necessary to enforce obligations. Such authorizations are necessary to prevents overdiligent data controllers from “overdoing” their obligations to the extent that they become a nuisance to the data subject. This problem is discussed from a legal perspective and is addressed in a technical solution that keeps a clear separation between authorizations and obligations.