Law

I looked for every health data system that shares features with my Medical Snapshot proposal, something I’ve been working on since 2007. Such programmes medically measure people over time, store what they find, and don’t usually tell the individuals what their own data says. This article summarises what I have learned by looking at 25 existing systems, covering 90 years from the Tuskegee Syphilis Study ↗ (1932) to Our Future Health ↗ (2022). I have tried to indicate my biases and assumptions but the purpose of these notes is to inform my own thoughts about the Snapshot concept. I also came across built-in biases in search engines. ...

This page contains the working behind the Health Observer Systems comparative review of the Medical Snapshot system: feature definitions, search and source notes, and the full scoring table. The R source reproduces the plots. This is very boring but I’m showing how I got to my conclusion. If someone is into statistics and would enjoy improving this design then yes please I’d love to hear from you. My research question This analysis is an exploration of how existing systems compare to my hypothetical Snapshot system. The matrix measures how close each system comes to the Snapshot’s architecture, asking the narrow question: which of the Snapshot’s features has each existing system implemented? ...

This is about an Observer-only Medical system, which can be immensely useful to society and governments, helping understand health and reducing suffering. There are many such systems but all of them have a common principle: individuals have their health monitored and are not told the results. So what’s in it for the individual who gives up the right to their own health data? I started thinking about this while working in health systems (the Internet Archive found a version from 2010 ↗). Over the years since then I have been variously employed in privacy, data sharing/donation, safety in health data movements, causality and risk assessment and my original background of cybersecurity - all of which are combined in observer health systems. When I realised my idea was not new at all, I compared it with 25 existing systems over the last 90 years, using a scoring system and graphical analysis. ...

These matters of complicated jurisdiction and sovereignty law require the advice of an experienced international lawyer. These lawyers need the advice of experienced international technologists, and that is the bit I do. Each has to know quite a bit about what the other is doing, so I study the relevant statutes and speak to the people who are drafting the next versions of the regulations. The EU-US Data Privacy Framework (DPF) ↗ is intended to put limits on US surveillance of EU citizens (with UK citizens covered in a bolt-on called the “bridge”). It always was a kludge designed to allow US companies to continue holding vast amounts of EU/UK data regardless of US government spying, and now it is on is on life support. The US Privacy and Civil Liberties Oversight Board (PCLOB) was a mandatory requirement for the deal but it has only one term-expired member, and the equally essential FISA Section 702 ↗ expired in June 2026. The expiry does not stop the surveillance, just the oversight that was negotiated. EU/UK businesses want to store their data within US control, and so these laws and frameworks are designed to make it legal for them to do so. In practical terms there is no protection for EU/UK citizens, so the legalities are a kind of compliance dance, and a very expensive one too. ...

While working with the Rule-based Epidemic Modelling group at the University of Southampton ↗ I began to consider the wider context, outside our core area of studying malaria. On the one hand, the techniques of epidemiology save lives at scale, but on the other, emerging diseases and newer health-related epidemics are accelerating. It seemed as if the field of epidemiology was really struggling, and indeed that turns out to be true. Most of the world has now adopted a new, holistic and systemic approach to healthcare, called One Health. One Health treats ecology, animals and humans as a system of systems across dozens of science fields, using the language of epidemiology. ...

Patents and the MIT License Some of my software projects use MIT so I have studied this issue. Although in many respects the world has moved on from copyright wars to much higher-stakes legal shenanigans, the detail of licensing still matters. In my case: My LumoSQL project is based on probably the most-used software, SQLite, whose license states it is in the “Public Domain”. The meaning of this isn’t entirely clear in some cases, and a 21st century software project starting decades after SQLite shouldn’t copy this. I chose MIT as a commonly accepted alternative, but which license is that exactly, and what does the text imply about patents? This is known, but I had to dig. The MIT license is massively used, but who will defend it if needed? We know the answer for the GPL, and also Apache-type licenses. I am now satisfied that quite a lot of enormous organisations really do care about MIT. There are lots of reasons why MIT isn’t ideal, but in my view those are trumped by it being widely accepted as fit for purpose, and relied upon by organisations who care that it remains effective and unambiguous. My notes are mostly kept in my many contributions ↗ to the Wikipedia page on the MIT License ↗ since that is where the decades-old knowledge of the MIT license origins is already maintained. The legal minds in many of the largest companies in the world seem to accept that at least in the US the MIT license implies a patent grant. As probably the most-used open source license, the MIT license has many wealthy corporate defenders if anyone wanted to test that idea.

This file is a Code of Conduct first written in 2020 for the LumoSQL project, with the heading: This file exists because the LumoSQL Project needed it, less than one year after starting in 2019. We take it seriously, and hope that most English-reading adults can understand what is said. We hope this is not needed very often. Collective kindness is needed more than ever in this global pandemic. Here is Version 1.6 – Updated 9th February, 2026. ...

The detail of the GDPR and its implied computer science contain a solution for sharing secrets according to law. This continues to be true in 2026, as the Digital Omnibus Regulation ↗ takes shape. Executive Summary The GDPR sets up a conflict in trust between companies in particular circumstances, which can only be resolved by using the automation of a cryptographic audit trail with particular properties as described below. Problem Statement Under the EU’s GDPR ↗ law virtually every company is a Controller, and virtually all Controllers use at least one Processor. When a Processor is engaged, the GDPR requires that a contract is signed with the very specific contents spelled out in clause 3 of Article 28. The GDPR requires that Controllers and Processors cooperate together in order to deliver data protection, and this cooperation needs to be very carefully managed to maintain the security and other guarantees that the GDPR also requires. That’s what this mandatory contract is intended to achieve. ...

When Linux was a Struggling Challenger 💡 Key Point This is a 2026 restoration of my (Dan Shearer’s) 1998-2001 guide, preserved at archive.org ↗. Links have been updated to point to the archives where possible. In 1999 I joined my first startup, Linuxcare in San Francisco. The Linuxcare story is a quintessential United States dot-com bubble narrative, featuring a famous venture capital fund, massive growth, a failed IPO, and a fancy new ex-IBM CEO resigning under a cloud. Founded in 1998, Linuxcare aimed to be the “0800 number for Linux”. So close! ...

This is the second time ↗ the Court of Justice has decided the same question. After four years, in 2020 the Court concluded that the United States violates the privacy of EU citizens when the personal data of EU citizens is visible to the US government, and that the US has no intention of changing its behaviour. Therefore, US companies are not permitted to hold the personal data of EU citizens and residents. ...