How can I discover what regulations a biomedical device needs to meet? Please note: the contextual jurisdiction of this question is primarily the United States, but could be extended to European and Asian countries as well. The OpenBCI is a recently-funded startup that will provide open source hardware (that is, open for any derivation but requiring attribution) capable of reading biodata such as "brain waves" (EEG), as well as heart (EKG) and muscle movement (EMG) data. It is clear from their site that this is not meant to be used as a medical and/or clinic/diagnostic tool, and is just a (high quality) hobbyist toy. However, because it is a high quality "hobbyist tool", there's no reason why someone couldn't come along and build a commercial hardware device on top of its design (it's open source, afterall). This is actually pretty common in the electronics industry. You take an open source design (to save yourself the hardship of designing your own circuit/system from scratch) and then extend its capabilities to suit your commercial/proprietary interests. I am interested in doing this, however the commercial device that I plan on building would be used in a biomedical/clinical setting. As such, there will be legal medical standards I need to ensure the hardware/firmware/software live up to. I believe this would be: IEC 6061; and FDA CRA 21 HIPAA (?) However I am not sure if this is a comprehensive list or not. What I'm asking here is: how do I know what standards I must design my device (hardware + software) to live up to, for its intended purpose, inside the intended jurisdictions (which like I said are primarily USA, but might also be Europe and Asia)? Are there agencies I can call? Websites I can turn to? Places like Underwriters Laboratory ("UL") that I can consult? To make a safe, legally-compliant and industry-compliant biomedical device, one must build that device to a certain set of standards. How do I find out what those standards even are?
To make a safe, legally-compliant and industry-compliant biomedical device, one must build that device to a certain set of standards. How do I find out what those standards even are? For one, start reading: http://www.fda.gov/MedicalDevices/ResourcesforYou/Industry/default.htm The FDA is one of the primary regulatory bodies that you will work with in terms of the development and potential marketing of a device. There are many documents and contact links, such as for information on standards, inspections, third-party reviews, existing device databases, workshops, etc. Especially relevant from the Division of Industry and Consumer Education (DICE): The Division of Industry and Consumer Education (DICE) answers questions (by phone and email) from the medical device industry .... In addition, DICE develops educational resources for the FDA website to help the medical device industry understand FDA regulations and policies. Your conclusions and decisions may lead you to other government bodies, such as the Small Business Administration, the US Patent Office, and similar offices in other countries if you go that route. And, because you are potentially entering into a field and endeavor that has huge liability for yourself and your business and possible investors, it's not a good idea to trust the judgement of the general public on a site like LSE; there are many private medical and legal consultants available by Google that could act as as consultants and leads for such a project.
There are two relevant bodies of EU law to consider here. The GDPR covers processing of personal data. Personal data is any data where the data subject can be identified directly or indirectly. The ePrivacy directive is also relevant, and covers how you may access and store information on the user's device. Directives are not directly applicable law. Instead every member state translates the directive into national law. In the UK, ePrivacy is implemented by PECR. Is the data you collect personal data in the sense of the GDPR? Yes: that hashed unique device ID or a system-provided advertising ID likely is personal data, and any linked data would then be personal data as well. This is going to be the case in particular if you store user accounts on your server and can connect these bug reports to a user. Consider also whether the game save could include personal data, and whether the video clip could be analyzed to identify the data subject. Does this mean collecting this information in bug reports is forbidden? No, the GDPR doesn't forbid or allow anything outright. Instead, you should go through the compliance process. In a nutshell: determine the purpose of this processing, e.g. “fixing bugs” find an Art 6 legal basis for this purpose, e.g. “Art 6(1)(f) legitimate interest” or “Art 6(1)(a) consent” if the legal basis is legitimate interest, you must balance that interest against the data subject's interests determine whether your compliance requirements include creating/updating your Records of Processing, or whether you have to write a Data Protection Impact Assessment implement the processing in a manner that respects GDPR principles such as Transparency and Data Minimization if the legal basis is legitimate interest you must implement an opt-out solution if the legal basis is consent, you must request consent first in a manner that satisfies the Art 7 conditions for consent – and allow consent to be revoked easily prepare to satisfy data subject rights: information requirements per Art 13, usually done in the privacy policy right to access, rectification, erasure, and data portability right to object (opt-out) and to restrict processing be aware of your general requirements a data controller to process this data securely, e.g. use HTTPS connections to transmit bug reports, take steps to protect your own accounts (e.g. 2FA), and ensure you have a suitable contract with any data processors that act on your behalf, e.g. cloud providers or contractors I would question whether your bug reports really need to include a device ID. That isn't forbidden, it just complicates compliance a bit. And what about ePrivacy? The ePrivacy directive is known for its cookie consent requirements. But these consent requirements apply when accessing any information on the user's device, or when applying equivalent fingerprinting techniques. Your game save is not an issue because it is necessary for the game. But that device ID and other system information is more difficult. So what to do? Compliance isn't trivial, but certainly possible. You will likely process the bug reports under your legitimate interest, but might still have to collect consent for accessing a system ID due to ePrivacy. Such a screen might look like this: Oh no, the game crashed! Do you want to send a bug report to the developers? Your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, collect system information and send bug report No, do not send bug report You could make an argument that a bug report can be sent in any case, and that you just need ePrivacy consent to collect useful system information. For example: Oh no, the game crashed! When sending a bug report to developers, do you want to include extra system information (link to details) that helps fixing the problem? In any case, your bug report will be protected as per our privacy policy (link). Your bug report will contain the following information: … Yes, send bug report with extra system information No, send anonymous report
The connector is patented, as you see here. It contains 57 claims which define what is protected, and 35 USC 116 spells out the logic of claims (which, in a nutshell, says "this can get really complicated"). The set of claims defines what it patented, and infringement is defined in 35 USC 271 as whoever without authority makes, uses, offers to sell, or sells any patented invention, within the United States or imports into the United States any patented invention during the term of the patent therefor, infringes the patent that is, there isn't anything statutorily more specific about how similar similar is. Since the claims define what is protected, this generally is taken to refer to things that are the same w.r.t. to all of the claims. "Generally" means that there is a doctrine of equivalents, exemplified by Warner-Jenkinson Co. v. Hilton Davis Chemical Co. 520 U.S. 17, whereby a court may find infringement when there is an insubstantial difference between the allegedly infringing thing and the protected invention. The Apple patent does not specify a specific number of millimeters between the contacts, so making a connector that is exactly the same as the Apple device (as marketed) but with different spacing on the connectors would be an infringement, because that spacing is not specified in a claim. A similar device that uses chewing gum rather than magnets to keep it together would not likely be found to be infringing since that is a substantial divergence from what Apple claims it has invented.
That is a very broad clause, broader than the default US rule for copyright, for example. (I know the question asked about the UK, I just happen to know the US copyright rule.) It would seem on the face of it to include independent research on a subject totally unrelated to the person's employment, done off the company's premises and not during normal work hours, but while the person was an employee.. Indeed it would arguably include the copyright to a novel written off premises and during off hours. Use of "course of employment" (instead of "term") would improve the provision. so would "as a part of his or her employment" or "closely related to the subject of his or her employment". Another possible restriction would be "Using the Company's facilities and/or equipment, or during normal working hours". However, my experience is that an employer will have drafted whatever language it uses through its company lawyer, and will be quite unwilling to alter it in any way. A prospective employee will probably be faced with a take-it-or-leave-it choice unless that person is a nearly indispensable figure to the company. One could send the company a certified letter saying, "When i signed the contract agreeing to {company language} I did not intend to include any developments made off company premises, not using company equipment, and unrelated to the subject or scope of my employment. I retain full rights to any such developments." Such a letter would help establish that there was no meeting of the minds to assign such non-employment-related developments or IP to the Company. How much weight it would have if the rights to such developments were the subject of a court case I am not sure.
By &quot;unlicensed&quot; you mean that it doesn't state a license for use (MIT, GPL, etc.)? Those licenses are just a codified bundle of terms of use that cover many many edge cases. You have in place a much simpler agreement that covers the primary situation: you using/modifying the code for your own use. It's just like borrowing a car. You will ask a friend &quot;hey, could I borrow your car for a bit?&quot; &quot;sure!&quot;. You know there's a possibility that you'll get in an accident or something weird will happen, but you think the chances of that are minimal and you would be able to work it out. If you ask a car rental company, they'll give you a full contract covering every situation that may happen. Similarly, a large company would be hesitant to borrow a car for corporate use without a legal framework surrounding it. So you will likely be in the clear if you are just using it for a small project with minimal legal/financial implications. If you plan on turning your project into a multi-billion dollar empire, you should revisit your agreement.
Informed consent is required for a surgical procedure. &quot;Informed&quot; includes having knowledge of the risks. The relevant legal question would be whether the doctor in question did adequately apprise the patient of the risks. On an individual basis, patient A could sue doctor X for the resulting harm. It is possible that 5 patients might sue the same doctor on this basis, which gets expensive and inefficient. If there is a well-defined and large-enough class, it may be possible for the action to be certified as a class action. 20 people might be a large-enough class. The defendant would be &quot;whoever is responsible for the wrong&quot;. That might be a single practitioner, or a hospital that the practitioner(s) work for. The hospital is an obvious plaintiff, if they failed in their duty to assure that their employees adequately informed patients of the risk.
As always, it depends. However, it is by no means certain that any public facing hobby project, such as a web app, is exempt from having to comply with the GDPR. Since the GDPR is only a few days old, we have of course no case law based upon the GDPR itself yet. However, when considering this, one should take the following two facts into consideration. 1. The "personal use exeption" in the GDPR is not new. The personal use exemption is unchanged from the article 3(2) of Directive 95/46/EC. (There as a lot of lobbying for removing "purely" from the sentence – but drafters wanted to keep it.) 2. Case-law under the previous regulation restricts the scope of the exception The ECJ has ruled on the scope of the personal use exception in two cases: C-101/01 C-212/13 In both these cases, the ECJ took an extremely restrictive view, and concluded that the personal use exemption did not apply to the processing done by these individuals. In C-101/01 it can be argued that the hobby project as a blogger was connected to the controllers professional activity (she was a catechist in a local church, and blogged about her work. including her colleagues). But in C-212/13, there no such connection to professional or commercial activity. Here, the controller operated a CCTV to protect his home, but set it up to also capture public space, and that was enough for the ECJ to decide that the personal use exception did not apply. Discussion Case-law based upon Directive 95/46/EC is in no way binding for a future court that need to rule based upon the GDPR. We need to wait for case-law decided under the GDPR to be able to have some degree of certainty about the scope of the "private use exception" under GDPR. However, given what we know about how the ECJ has ruled in these cases in the past, I think it is hazardous to think that just because what you are doing on the web is just a "hobby project" not connected to professional or commercial activity, you are exempt from complying with the GDPR. Conclusion IMHO, you may be exempt, or you may not be exempt. I think it really depends on your activity in your hobby project, and to what extent this project processes the personal data of other people than yourself.
Yes and no. [note, the following is all written about US law. In other jurisdictions laws are, of course, different (though usually not drastically so.)] In the US there are (at least) three different bodies of law that might apply to code: copyright, patents, trade secrets. Copyright covers original expression. Anything you write is automatically, immediately protected under copyright. The copyright applies to the code itself, and anything "derived" from that code. It's up to the courts to decide exactly what "derived" means. One case that's long been viewed as a landmark in this area is Gates Rubber v. Bando Chemicals. The Court of Appeals for the tenth Circuit decision includes a section titled: "The Test for Determining Whether the Copyright of a Computer Program Has Been Infringed." Note that you can register a copyright, and that can be worthwhile, such as helping recover some damages you can't otherwise. Patents are quite different from copyrights. Where a copyright covers expression of an idea, a patent covers a specific invention. Rather than being awarded automatically, a patent has to be applied for, and awarded only after the patent office has determined that there's no relevant prior art to prevent it from being awarded. A patent, however, covers things like somebody else independently discovering/inventing what's covered by the patent. A trade secret could (at least theoretically) apply to some process or procedure embodied in the code. A trade secret mostly applies to a situation where (for example) you're trying to form an alliance with some other company, and in the process tell them things you don't tell the general public. If you've identified the fact that what you're telling them is a trade secret, and they then tell a competitor (or the general public, etc.) or more generally use that information in any way other than the originally intended purpose, it could constitute a trade secret violation. As a side-note: patents and copyright fall under federal law, so they're basically uniform nation-wide. Trade secrets mostly fall under state law, so the exact details vary by state. Absent a reason to believe otherwise, I'd guess your interest here is primarily in copyright infringement. The key here would be showing that one piece of code was derived from the other. That is, it specifically would not apply in a case where there were only a limited number of ways of doing something, so anybody who wanted to do that had to use one of those ways. Since this would not indicate actual derivation, it would not indicate copyright violation.