3 ms·

> In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. S

by orwin 3y ago

> In particular, “digital artisans” using Open Source software at small scale – the main concern of Debian – will need guidance from the European Commission. Sadly I don't think it will move, the commission doesn't want to weaken the legislation because they don't want to much discrepancy between member states. It will once again be up to individual countries to set up this law with their own interpretation. In my experience with Rgpd, the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations, especially if you are incidentally its target (As a PaaS that hosted health data, we were). I understand that this is both unclear, unknowable and a pretty huge risk (not really factually, but it feels like one): I'm not saying Debian people are wrong to want to clarify, I'm not saying people should take this as a victory, or that EU is perfect : I'm just saying that as a complex federation, with current rules, this law will probably be the best we will get, and sadly, local 'forgiveness' and loose execution is the only thing you can count on. Because in the EU eyes, the law being loose is way, way worse than the local executive power being loose.

robertlagrant 3y ago
> the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations This is a bad dependency to have. For example, for the new EU medical device regulation, IVDR, a lot of the regulatory infrastructure just isn't ready[0], and many bodies are bowing out due to the complexity. Ironically, the British Standards Institute is one of the few notified bodies to take it on! And that's medical devices, which are a tighter form of software. Regulating software in general seems like a very difficult task. [0] https://www.degruyter.com/document/doi/10.1515/cclm-2021-0975/html https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...
- orwin 3y ago
  Yes, I think I was unclear: depending on local governmental watchdogs/agencies goodwill isn't a good solution. It's the one EU choose however. It's weird for Anglo countries, or countries with the Anglo law system, where the legislation might have holes and weak points, but decree and case law fill those holes (the French system work like that too). EU can't do that because it's a federation of countries with different culture and interest. Again, not saying it's good, I'm saying that's how it works.
- WA 3y ago
  I still wonder who enforces the MDR if a company from outside the EU offers their app/software to EU citizens without any certification. There are quite a few health apps that are considered medical devices under MDR, but not in other countries. The EU companies must comply with the regulations, but nobody seems to be responsible for removing non-certified apps made by non-EU companies. That is a huge competitive disadvantage for EU companies.

by orwin 3y ago

robertlagrant 3y ago

> the watchdogs in at least 3 countries (France, Italy, Germany) are extremely helpful in navigating regulations This is a bad dependency to have. For example, for the new EU medical device regulation, IVDR, a lot of the regulatory infrastructure just isn't ready[0], and many bodies are bowing out due to the complexity. Ironically, the British Standards Institute is one of the few notified bodies to take it on! And that's medical devices, which are a tighter form of software. Regulating software in general seems like a very difficult task. [0] https://www.degruyter.com/document/doi/10.1515/cclm-2021-0975/html https://www.degruyter.com/document/doi/10.1515/cclm-2021-097...

orwin 3y ago
Yes, I think I was unclear: depending on local governmental watchdogs/agencies goodwill isn't a good solution. It's the one EU choose however. It's weird for Anglo countries, or countries with the Anglo law system, where the legislation might have holes and weak points, but decree and case law fill those holes (the French system work like that too). EU can't do that because it's a federation of countries with different culture and interest. Again, not saying it's good, I'm saying that's how it works.
WA 3y ago
I still wonder who enforces the MDR if a company from outside the EU offers their app/software to EU citizens without any certification. There are quite a few health apps that are considered medical devices under MDR, but not in other countries. The EU companies must comply with the regulations, but nobody seems to be responsible for removing non-certified apps made by non-EU companies. That is a huge competitive disadvantage for EU companies.