Rules

After this lesson, the reader should understand:

• 01Classify a rule by modality: obligation, permission, prohibition.
• 02Split compound prose into atomic rules.
• 03Attach each rule to the authority that issues it.

One sentence, four rules

A single compliance sentence carries four obligations. Why does that matter?

Take one clause: 'On discovering a personal data breach, the data controller must notify the supervisory authority within seventy-two hours, must record the breach in the internal log regardless of notification, may delay notifying affected individuals if the risk to them is assessed as low, and must notify affected individuals without undue delay if the risk is assessed as high.' As prose, this is one sentence, evaluated and audited as one unit; it holds or it doesn't. Decomposed, it is four atomic rules, each with its own subject, modality, action, condition, and consequence: notify the regulator (must, within 72 hours, or the delay is itself a separate reportable failure); log the breach (must, always, or there is nothing later to audit); delay individual notice (may, if risk is low — no penalty for exercising the permission); notify individuals (must, if risk is high, or affected people lose the window to protect themselves). A controller who notifies the regulator and logs the breach, then misses the individual-notification deadline, has failed one rule of four — not the clause. Reported as prose, that is non-compliance. Reported as four rules, it is what actually happened: three held, one failed. The modality mix is not incidental either: 'must' and 'may' are different logical operators, not two tones of the same instruction; the distinction the field traces to von Wright's formal separation of obligation from permission^[1]. Atomising a sentence does not just break a paragraph into smaller pieces. It recovers the units of institutional behaviour the prose was hiding. The clause is not invented. It simplifies the structure of the GDPR's breach provisions^[2]: Article 33 requires notifying the supervisory authority within seventy-two hours and documenting every breach regardless, and Article 34 requires telling affected individuals when the risk to them is high. The real text goes one step further than the paraphrase, and the extra step is instructive. Where notification to the authority is late, it must be accompanied by reasons for the delay. That is an obligation that only arises once another obligation has been broken — what logicians call a contrary-to-duty obligation^[3] — and it is notoriously awkward to represent: a naive encoding either treats the late notice as compliant or loses the duty to explain. The strongest objection is that atomisation destroys the clause's unity. The four duties are not independent — they share a single risk assessment, and a court reads a provision as a whole. True, and the atoms should not pretend otherwise. The shared risk assessment becomes one named definition that two rules reference, not two copies that can drift. Atomisation changes the unit of evaluation and audit; it does not license reading each atom without the others.

• When is a compound rule clearer than its atomic parts?
• How should conflicting rules of equal authority be resolved?
• Should a rule carry its own penalty, or reference one?
• How should an artifact represent an obligation that only arises once another has been breached?

No responses yet. Be the first to answer one of the questions above.

Atomise a compliance clause.

1. 01Split the clause into single-obligation statements.
2. 02Label each with its modality and subject.
3. 03State the condition set for each.
4. 04Identify any obligation with no stated consequence.