Instructional goals
The laboratory aims to provide students with essential and applied knowledge of data law and cybersecurity, as the second segment of the progressive educational pathway devoted to the relationship between intelligent machines and law. The course seeks to develop students’ ability to understand the role of data, as well as their protection, sharing, and security within the European digital ecosystem, while fostering the acquisition of the legal, technical, and operational skills needed to assess the implications of digital technologies and artificial intelligence.
Through a laboratory-based approach grounded in the analysis of cases, decisions by competent authorities, relevant case law, and simulations, the course addresses the foundations of personal data protection, with particular reference to the GDPR, the principles governing processing, legal bases, data subjects’ rights, accountability, and the duties of controllers. The laboratory also introduces the European regulatory framework for data, with specific attention to data sharing, reuse, interoperability, common European data spaces, and the relationship between personal data protection and new forms of data governance. A dedicated part of the course focuses on cybersecurity, the main cyber threats and countermeasures, as well as the regulatory logic of the NIS2 Directive.
The objective is to train jurists capable of critically interpreting and operationally applying rules on data and cybersecurity, while understanding the complementarity between personal data protection, data governance, and cybersecurity in the context of digital innovation.
Prerequisites
None.
Intended learning outcomes
Knowledge and understanding: students will acquire a basic knowledge of data law and cybersecurity, understanding the role of data protection, sharing, reuse, and security within the European digital ecosystem.
Applied knowledge and understanding: students will apply the knowledge acquired to the analysis of practical cases, decisions by competent authorities, case law, and simulations, identifying the relevant legal issues in the fields of data and cybersecurity.
Making judgements: students will collect, select, and interpret legal sources, decisions, data, and relevant information, critically assessing the legal, technical, and organisational implications of the technologies examined.
Communication skills: students will communicate clearly and appropriately problems and solutions relating to data protection, data governance, and cybersecurity, using adequate technical-legal language.
Learning skills: students will develop the skills necessary to continue independently the educational pathway in intelligent machines and law and to update their knowledge in light of technological and regulatory developments.
Course Contents
Foundations of Data Protection
Overview of EU Data Regulation
the Data Governance Act and the Data Act: data reuse, sharing, intermediaries, and data altruism
interoperability and Common European Data Spaces
the proposed Digital Omnibus
pseudonymisation and anonymisation
Foundations of Cybersecurity
typical cyber threats and attacks
risk factors and physical, logical, and organisational security countermeasures
the structure and regulatory logic of the NIS2 Directive
Reference Books
Teaching materials consist of the content of the lectures delivered by the instructor, the related handouts, and other materials shared on MyLuiss.
Recommended readings (mandatory for non-attending students!):
For data law:
Handbook on European Data Protection Law
https://fra.europa.eu/sites/default/files/fra_uploads/fra-coe-edps-2018-handbook-data-protection_it.pdf
For computer security:
G. Corasaniti, Sicurezza informatica e intelligenza artificiale. Rischio e resilienza nello spazio giuridico europeo, Giappichelli, 2025.
S. Aterno, Come la Cybersicurezza influenzerà la privacy, 2016.
Come la (cyber)sicurezza influenzerà la privacy - Formiche.net.
S. Aterno, La sicurezza come diritto di libertà e il ruolo della privacy nel prossimo futuro, 2 July 2015.
https://www.stefanoaterno.eu/documenti-accademici/
Teaching Methods
Learning: lectures
Practice: case studies and simulations
Inquiry: analysis of ideas and information across a range of materials and resources, using legal databases to collect and analyse data and compare texts
Collaboration: small-group work, discussion of peers’ findings, and development of shared outcomes
Discussion: seminars and in-class group discussions
Production (potential): reports and presentations
Assessment Method
The final grade, expressed on a 30-point scale and included in the overall grade point average, will be determined on the basis of the following components and corresponding percentages:
75% assessment of coursework completed during the course, consisting of at least two in-class graded exercises/simulations, conducted as follows:
A graded in-class exercise consisting of a simulated legal problem-solving task concerning the topics covered in the previous lectures.
A simulation of a practical case involving multiple implications. Students, working in groups, will be required to address a practical case concerning a cyberattack and subsequently present to the Professor the facts, the consequences, the relevant applicable legal provisions, and the solutions adopted. The Professor will question the students in each group, addressing questions both to the group as a whole and to individual students, and will assign a grade that will count as the grade for the interim assessment.
10% active participation in class
15% final examination (oral)
Thesis assignment criteria
---
Week 1
Systematic overview of the subject matter.
From the right to privacy to the right to the protection of personal data.
Implications for data and personal information: innovation, new technologies, and the digital future
International and European framework
National rules
The relationship with other fundamental rights and freedoms
Week 2
Definitions and actors
categories of data
processing activities
actors involved in processing: controller, processor, data protection officer (DPO), joint controllers, sub-processor, authorised persons, and data subjects
Relevant judicial decisions (by way of example): Prato Civil Court, Judgment No. 665 of 19 August 2024
Week 3
Principles relating to processing
lawfulness, fairness, and transparency of processing
data protection by design and by default
transparency
purpose limitation
data minimization
accuracy, storage limitation, and security
responsibility and accountability
Week 4
Data subjects’ rights
the right to be informed and the right of access
the right to rectification
the right to erasure, with a focus on the right to be forgotten
the right to restriction of processing
the right to data portability
the right to object
rights relating to automated decision-making, including profiling
Analysis of relevant decisions of the Italian Data Protection Authority and/or judicial decisions, including (by way of example):
CGUE, C-131/12, Google Spain SL e Google Inc. c. Agencia Española de Protección de Datos (AEPD), Mario Costeja González [GC], 13 May 2014
Provv. GPDP n. 505 of 13/12/2018, doc. web n. 9075345
Cass. 22 giugno 1985, n. 3769
Week 5
In-class graded exercise consisting of a simulated legal problem-solving activity concerning the topics covered in the previous lectures.
Week 6
Conditions for the lawfulness of processing, with a focus on consent and legitimate interest.
The e-Privacy Directive and the legal framework governing cookies and other tracking technologies.
Analysis of relevant decisions of the Italian Data Protection Authority and/or judicial decisions, including (by way of example):
CGUE, C-13/16, Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde c. Rīgas pašvaldības SIA «Rīgas satiksme», 4 May 2017
Week 7
Concepts of security and cybersecurity: basic notions and overview.
Cybersecurity as an essential function within the national system.
European and national framework
Case studies that, over recent decades, have led sovereign States to change their approach to cybersecurity
Typical cyber threats and attacks, risk factors, and physical, logical, and organisational security countermeasures (continued)
Week 8
Typical cyber threats and attacks, risk factors, and physical, logical, and organisational security countermeasures (continued).
The regulatory framework for cybersecurity in Europe and Italy. Fundamental principles and obligations under the various cybersecurity rules (Part I):
security measures under Article 32 GDPR and applicable principles. Case studies;
data breaches under Articles 33 and 34 GDPR. Case studies.
Week 9
The regulatory framework for cybersecurity in Europe and Italy. Fundamental principles and obligations under the various cybersecurity rules. Case studies (Part II):
the NIS2 Directive and Legislative Decree No. 138/2024: structure and regulatory logic of the NIS2 Directive;
the Cyber Resilience Act, Regulation (EU) 2024/2847, concerning mandatory cybersecurity and vulnerability management requirements for all hardware and software products placed on the EU market;
brief overview of DORA, the Digital Operational Resilience Act, Regulation (EU) 2022/2554, on strengthening operational resilience in the financial sector;
brief overview of the CER Directive, the Critical Entities Resilience Directive, laying down rules on the security and resilience of critical infrastructure.
Week 10
Security and artificial intelligence. Article 15 of the AI Act, the European Regulation on Artificial Intelligence: security of AI systems and security within AI systems.
The case of AI systems such as Mythos, Fable 5, ChatGPT Cyber, and others.
Security obligations and security measures for entities using artificial intelligence systems.
Week 11
Managing cyberattacks and security incidents: obligations and procedures for undertakings, public bodies, and public administrations.
Institutions and competent authorities in the field of data and information security.
Presentation of real-life cyberattack cases, with their different implications and impacts on services, critical infrastructure, and data.
Analysis of real cases and in-class simulations of cyberattacks, with active student participation.
Week 12
Practical case / graded exemption test: simulation of a real case with multiple implications. Students will address, in groups, a practical case concerning a cyberattack and will then present to the Professor the facts, the consequences, the relevant applicable rules, and the solutions adopted.
The Professor will question the students in each group, both collectively and individually, and will assign a grade that will count as the grade for the exemption test.