DrLeturc commented 2 years ago

Regulating platforms

The motivating scenario

MAS4Factory4.0 is a physical and virtual digital factory for 3D printing and a cooperative space where companies, researchers and student engineers work together. In such cooperative, there are robotic agents that use and control plug-in tools to produce parts. Recently, they have integrated a HMAS in MAS4Factory4.0, nammed HMAS4Factory. This HMAS allows also to robotic agents to know how to use tools but also it is a way to regulate agents, and ensure that standards are met with the platform.

For instance, an user, after logging in, can order from the web interface the machining of a prostheses remotely and the agents coordinate to make the different parts. However, for the printing of the prostheses, the platform needs also to collect personal data information about the patients.

In this scenario, we want to ensure that the GDPR standards have been met by the platform.

1) Case of the prostheses without medical purpose (e.g. toy) :

One of the platform's specialties is 3D printing of prostheses. There is a customer who orders a 3D print of prostheses and he will have to provide a model of his 3D print.

In order to make the order, the users has to fill a form where he needs to put his personal data :

name
address
email / phone number (to contact)
data concerning health : e.g. size of the arm, shape, etc.
user preferences : color of the prostheses, ...

The goal of this motivating scenario is that the platform needs to be compliant with GDPR. If it is not compliant, then [the company] must make it compliant.

This situation is associated with the following legal situations :

the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;

2) Case of the prostheses with a medical purpose :

This situation is associated with the following legal situations :

processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

Informal competency questions

The list of covered features as informal competency questions :

How to describe a GDPR rule : what is permitted, forbidden, or obligatory ?

The following feature is not covered by the motivating scenario :

How to describe and detect the violation of a GDPR rule ?
How to describe and apply sanctions?

A glossary of new terms

List of new terms introduced by the motivating scenario :

norm : A norm is a standard for evaluating or making judgments about behavior or outcomes **
GDPR : [General Data Protection Regulation](https://gdpr.eu/)
obligation : what compels an agent to give, to do or not to do something
personal data : means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; source
data concerning health : means personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status; Article 4.(15)
``

Related resources

Special categories of personal data which merit higher protection should be processed for health-related purposes only where necessary to achieve those purposes for the benefit of natural persons and society as a whole, in particular in the context of the management of health or social care services and systems, including processing by the management and central national health authorities of such data for the purpose of quality control, management information and the general national and local supervision of the health or social care system, and ensuring continuity of health or social care and cross-border healthcare or health security, monitoring and alert purposes, or for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, based on Union or Member State law which has to meet an objective of public interest, as well as for studies conducted in the public interest in the area of public health. Therefore, this Regulation should provide for harmonised conditions for the processing of special categories of personal data concerning health, in respect of specific needs, in particular where the processing of such data is carried out for certain health-related purposes by persons subject to a legal obligation of professional secrecy. Union or Member State law should provide for specific and suitable measures so as to protect the fundamental rights and the personal data of natural persons. Member States should be allowed to maintain or introduce further conditions, including limitations, with regard to the processing of genetic data, biometric data or data concerning health. However, this should not hamper the free flow of personal data within the Union when those conditions apply to cross-border processing of such data. 53

Link to query the related issues

Name of the domain : regulating-platforms.md

smnmyr commented 2 years ago

@clement1234567891011 have a look at this, viz. the working with Christopher.

DrLeturc commented 1 year ago

After discussion at the heartbeat meeting on 16 June 2023, we decided to close this issue because it is now out of scope before end of project at this stage.

HyperAgents / hmas