. . "The supervising authority may check the user information and associated rights management rules to determine whether access rights have expired, at which time access to user information is disabled such as by deleting the information." . .