"relationships" in /exercise payload

[jernst]

This appears to be a bit of a slippery slope, unless very crisply defined. If "relationships" specifies "customer", for example, a business may be tempted to only consider their customer databases for the scope of the request. This is probably not what the User wanted (are there real-world user stories where Users would want a scope other than "the entirety of the business"?)

I think one of the intents of privacy legislation is to cause businesses to take a hard look at where and how they manage personal information, and encourage them to consider reducing that footprint. If the User or the AA provides such hints, CBs may breathe a sign of relief, because it lets them argue to themselves that they don't need to look at the entire business.

Proposal: leave out. It's easier to put it back in in version 2.0, should it really turn out to be needed, than to remove it in 2.0.