lukaspie
commented
6 months ago Further comment from @mkuehbach:
As for the refactoring of EM and APM, I worked the following way: the existence constraint on group instances of NXuser are set to optional. If used, at least setting name is recommended. Personally, I am convinced that having an instance of NXidentifier in NXuser suffices. If that is then needed, NXidentifier can be extended with adding the option for this representing the concept of a decentralized identifier. For a given installation of an OASIS indeed it is the responsibility of the specific group of people who organize internally how they manage an OASIS in that this OASIS is configured in a way to not incentivize users or stricter to not allow people to breach the GDPR. Not our responsibility but indeed setting NXuser and name required right from the start is questionable as we encourage if not enforce problems. The real question though is another one: If I document in NXuser that there is a concept with symbol "name" and I write my name there what triggers that there is now the connection with me as a legal person? The string symbol representation of my name is not unique and indeed there are multiple people with my name. With NXidentifiers that is more tricky as e.g. a required ORCID would pinpoint exactly me. In short, technically I think this question is a solved problem. NFDI hopefully will decide or give a best practice recommendation as a whole we act accordingly make a few fixes in our machinery that complies to this. On another note, if I add a DOI of a publication to an appdef and define the concept of that DOI such like "paper whose first author is the person who performed the measurement and is legally responsible" will this have any legal value in court? Indeed, fascinating questions but most of which beyond our authority to decide.
In NXmpes, we had the dicussion about which fields in NXuser can be required/recommended. This issues serves as a way to keep track of the ideas and discussion points on 1) which fields should be required for data to be considered FAIR vs. what is allowed in accordance with GDPR or other data privacy regulations 2) the possible use of other (permanent) identifiers for the users. Examples include decentralized identifiers and nfdi base services adding support for identification information (IAM4NFDI).
@FAIRmat-NFDI/areab please feel free to add other approaches here.