DATA LAW AND COMPUTER SECURITY

The laboratory aims to provide students with essential and applied knowledge of data law and cybersecurity, as the second segment of the progressive educational pathway devoted to the relationship between intelligent machines and law. The course seeks to develop students’ ability to understand the role of data, as well as their protection, sharing, and security within the European digital ecosystem, while fostering the acquisition of the legal, technical, and operational skills needed to assess the implications of digital technologies and artificial intelligence. Through a laboratory-based approach grounded in the analysis of cases, decisions by competent authorities, relevant case law, and simulations, the course addresses the foundations of personal data protection, with particular reference to the GDPR, the principles governing processing, legal bases, data subjects’ rights, accountability, and the duties of controllers. The laboratory also introduces the European regulatory framework for data, with specific attention to data sharing, reuse, interoperability, common European data spaces, and the relationship between personal data protection and new forms of data governance. A dedicated part of the course focuses on cybersecurity, the main cyber threats and countermeasures, as well as the regulatory logic of the NIS2 Directive. The objective is to train jurists capable of critically interpreting and operationally applying rules on data and cybersecurity, while understanding the complementarity between personal data protection, data governance, and cybersecurity in the context of digital innovation.

None.

Knowledge and understanding: students will acquire a basic knowledge of data law and cybersecurity, understanding the role of data protection, sharing, reuse, and security within the European digital ecosystem. Applied knowledge and understanding: students will apply the knowledge acquired to the analysis of practical cases, decisions by competent authorities, case law, and simulations, identifying the relevant legal issues in the fields of data and cybersecurity. Making judgements: students will collect, select, and interpret legal sources, decisions, data, and relevant information, critically assessing the legal, technical, and organisational implications of the technologies examined. Communication skills: students will communicate clearly and appropriately problems and solutions relating to data protection, data governance, and cybersecurity, using adequate technical-legal language. Learning skills: students will develop the skills necessary to continue independently the educational pathway in intelligent machines and law and to update their knowledge in light of technological and regulatory developments.

1. Intimations of Data Protection (individual topics will be treated on a case-by-case basis through the decisions of the Supervisory Authority or relevant case law) • essential elements of personal data processing regulation: purpose, means, controller, data subjects, and conditions of lawfulness • principles applicable to data processing • legal bases • accountability and the duties of the controller • data subject rights 2. Overview of EU Data Regulation (individual topics will be treated on a case-by-case) • the Data Governance Act and the Data Act: data reuse, sharing, intermediaries, and data altruism • big data and open data • interoperability and Common European Data Spaces • the proposed Digital Omnibus 3. Foundations of Cybersecurity (here too, a practical approach should be preferred, where possible through concrete examples and simulations) • typical cyber threats and attacks • risk factors and physical, logical, and organisational security countermeasures • the structure and regulatory logic of the NIS2 Directive

Teaching materials consist of the content of the lectures delivered by the instructor, the related handouts, and other materials shared on MyLuiss. Recommended readings (mandatory for non-attending students!): • G.Ciacci-G. Buonomo, “Profili di Informatica Giuridica”, 3 edizione, capitolo 2; • F. Faini-S. Pietropaoli, “Scienza giuridica e tecnologie informatiche. Temi e problemi”, 2° edizione, Giappichelli,capitolo 5, paragrafo 8, e capitolo 8 interamente.

Learning: lectures and quizzes Practice: guest lectures by experts, case studies, and simulations Inquiry: analysis of ideas and information across a range of materials and resources, using legal databases to collect and analyse data and compare texts Collaboration: small-group work, discussion of peers’ findings, and development of shared outcomes Discussion: seminars and in-class group discussions Production: reports and presentations

The final grade, expressed on a 30-point scale and included in the overall grade point average, will be determined on the basis of the following components and corresponding percentages: 75% assessment of coursework completed during the course (midterm exam / assessment test) 10% active participation in class 15% final examination (oral)