DATA LAW AND COMPUTER SECURITY

The laboratory aims to provide students with essential and applied knowledge of data law and cybersecurity, as the second segment of the progressive educational pathway devoted to the relationship between intelligent machines and law. The course seeks to develop students’ ability to understand the role of data, as well as their protection, sharing, and security within the European digital ecosystem, while fostering the acquisition of the legal, technical, and operational skills needed to assess the implications of digital technologies and artificial intelligence. Through a laboratory-based approach grounded in the analysis of cases, decisions by competent authorities, relevant case law, and simulations, the course addresses the foundations of personal data protection, with particular reference to the GDPR, the principles governing processing, legal bases, data subjects’ rights, accountability, and the duties of controllers. The laboratory also introduces the European regulatory framework for data, with specific attention to data sharing, reuse, interoperability, common European data spaces, and the relationship between personal data protection and new forms of data governance. A dedicated part of the course focuses on cybersecurity, the main cyber threats and countermeasures, as well as the regulatory logic of the NIS2 Directive. The objective is to train jurists capable of critically interpreting and operationally applying rules on data and cybersecurity, while understanding the complementarity between personal data protection, data governance, and cybersecurity in the context of digital innovation.

None

Knowledge and understanding: students will acquire a basic knowledge of data law and cybersecurity, understanding the role of data protection, sharing, reuse, and security within the European digital ecosystem. Applied knowledge and understanding: students will apply the knowledge acquired to the analysis of practical cases, decisions by competent authorities, case law, and simulations, identifying the relevant legal issues in the fields of data and cybersecurity. Making judgements: students will collect, select, and interpret legal sources, decisions, data, and relevant information, critically assessing the legal, technical, and organisational implications of the technologies examined. Communication skills: students will communicate clearly and appropriately problems and solutions relating to data protection, data governance, and cybersecurity, using adequate technical-legal language. Learning skills: students will develop the skills necessary to continue independently the educational pathway in intelligent machines and law and to update their knowledge in light of technological and regulatory developments.

1. Fundamentals of data protection (using a workshop-style approach to convey the subject's fundamentals, addressing specific topics through case studies based on regulatory decisions or relevant case law; examples include:) • essential elements of processing (purposes, methods, data controller, data subjects, conditions for lawfulness) • legal bases • principles applicable to processing • right to be forgotten • accountability and controller obligations 2. Overview of EU data legislation • Data Governance Act and Data Act (reuse, sharing, intermediaries, and data altruism) • interoperability and European Common Data Spaces • the Digital Omnibus proposal • pseudonymization and anonymization 3. Fundamentals of cybersecurity (again, prioritizing a practical approach, ideally using concrete examples and simulations) • common cyber threats and attacks • risk factors and physical, logical, and organizational security countermeasures • structure and logic of the NIS2 Directive 4. Privacy and Artificial Intelligence - Large Language Models - Legal and justice sectors

Teaching materials consist of the content of the lectures delivered by the instructor, the related handouts, and other materials shared on MyLuiss. Recommended readings (mandatory for non-attending students): Giuseppe Corasaniti - Esperienza giuridica e sicurezza informatica

Learning: lectures- Practice: case studies and simulations Inquiry: analysis of ideas and information across a range of materials and resources, using data bases and the LLMs authorised by the University to collect and analyse data and compare texts

The final grade, expressed out of 30 and relevant for the overall average, will be based on the assessment of the following components, according to their respective percentage weights: 75% ongoing assessment based on two multiple-choice quizzes taken on the Moodle platform during the course 10% active participation in class 15% final exam (oral)