Instructional goals
This laboratory is the fifth stage of the overall didactic structure of Legal Informatics of the LUISS master's degree in Law, which is made up of five preparatory laboratories and a course spread over the first three years. These teaching classes constitute a unitary and progressive path according to a logical itinerary studied in order to implement the student's sensitivity for the mutual interaction between information technology and law.
The intent is to train a jurist who can be ready to face the legal challenges of the digital dimension, increasingly pervasive and transversal in every professional sector, and of IT applications in the legal sector.
To this end, the student will also have to acquire purely technical and IT knowledge to fully understand the technological phenomena of which he or she may be required to evaluate the legal implications and effects.
This is a strategic goal that the Department of Law has set itself, as it is impossible to imagine the figure of a jurist today who is not fully familiar with digital tools and is unable to analyze the impact of the most disruptive technological applications on society, law, markets and institutions at a global level.
The overwhelming innovation encouraged by national and European public policies requires versatile professional figures, capable of applying the traditional categories of law to unprecedented technological phenomena, or even of building new ones better able to regulate the present.
To do this, it is required an understanding of the basic architecture of networks, as well as the languages of mathematics and the logic of algorithms, in order to be able to read them in the forms of law.
The Digital Law and Data Protection Laboratory is the last of the laboratories of the Legal informatic course and as such it focuses on a relevant legal aspect inherent to the matter. In particular, a large part of the laboratory is dedicated to illustrating the European data protection regulation, embodied by the GDPR, but the growing regulatory production resulting from the launch of the European digital strategy requires to also address the issue of data protection interaction with new legal frameworks that encourage and regulate the data sharing in the markets of digital services. Equally important is the introduction to the issue of the complementarity between protection of personal data and cybersecurity.
Prerequisites
Laboratorio di Informatica Giuridica, Linguaggio e Logica delle Macchine, Intelligenza Artificiale, Intelligenza artificiale, machine learning e diritto.
Intended learning outcomes
Knowledge and comprehension: to achieve knowledge of some cutting-edge topics in the relevant field of study with the appropriate teaching support, knowledge of the fundamental elements of the European regulation on personal data protection and governance of data flows, knowledge of the main regulatory acts already approved and proposed relating to the European digital strategy, understanding of IT risks and of the security measures to prevent and repair them.
Applied knowledge and comprehension: devising and supporting arguments related to the topic of personal data protection, governance of data flows and cybersecurity.
Making autonomous judgements: collecting and interpreting relevant information and data in order to assess and prevent risks and seize opportunities in IT security.
Communication skills: communicating information, ideas, problems and solutions on data protection, data governance and cybersecurity.
Ability to learn: having developed the skills necessary to undertake subsequent studies with a high degree of autonomy.
Course Contents
I. The GDPR (EU General Data Protection Regulation)
II. Digital law
III. Data security and cybersecurity
Reference Books
Gianluigi Ciacci – Giovanni Buonuomo, “Profili di informatica giuridica”, CEDAM, Padova, 2021, pp. XIII-400, chapter 2.
Recommended readings: Handbook on European data protection law (ed. 2018), chapters 1-4, 6, 7,9,10.
Teaching Methods
Acquisition: lectures, podcasts and online quizzes
Practice: guest speakers, case study and simulation
Investigation: analyzing ideas and information in a range of materials and resources, using legal databases to collect and analyze data and comparing texts
Collaboration: small group project, discussing others’ output and building joint output
Discussion: seminars, group based class discussion, online forums and synchronous and asynchronous discussion
Production: essays, reports, presentations and blogs
Assessment Method
The final grade, expressed out of 30, will derive from the evaluation of the following items for the respective percentage share:
20% attendance
10% active participation during classes
50% intermediate tests
20% final exam (written and oral)
N.B. The grade obtained at the outcome of the exam of this Laboratory will participate for the share of 1/7 in the final grade which will be attributed to the outcome of the exam of the Macchine intelligenti e diritto (MID1) course and which regularly falls within the curricular average grade of each student.
Thesis assignment criteria
.
Week 1
I. The GDPR (EU General Data Protection Regulation)
1. From Directive 95/46 to the GDPR: the new "substantive" risk-based regulatory approach
Through lectures and analysis of ideas and information from a range of materials and resources
Week 2
I. The GDPR (EU General Data Protection Regulation)
2. Definitions, subjects and essential elements of the processing
Through lectures and analysis of ideas and information from a range of materials and resources
Week 3
I. The GDPR (EU General Data Protection Regulation)
3. Categories of data and conditions of lawfulness for the processing
Through lectures and analysis of ideas and information from a range of materials and resources
Week 4
I. The GDPR (EU General Data Protection Regulation)
4. Principles, accountability, data-protection-by-design and -by-default
Through class group discussions, small group work
Week 5
I. The GDPR (EU General Data Protection Regulation)
7. National implementation: Italian Privacy Code and Data Protection Authority
Through class group discussions, small group work
Week 6
I. The GDPR (EU General Data Protection Regulation)
6. Governance and accountability tools and procedures
Through class group discussions, small group work
Week 7
I. The GDPR (EU General Data Protection Regulation)
5. Rights of the data subject and focus on the right to be forgotten
Through class group discussions, small group work
Week 8
I. The GDPR (EU General Data Protection Regulation)
8. European Data Protection Board and the consistency mechanism
Through class group discussions, small group work
Week 9
I. The GDPR (EU General Data Protection Regulation)
9. International data transfers
Through lectures by expert guests, real-life case studies and synchronous and asynchronous discussions
Week 10
1. Law Enforcement Directive and ePrivacy
2. EU Digital Strategy: Digital Services Act and Digital Markets Act
Through class group discussions, small group work
Week 11
II. Digital law
3. EU Data Strategy: Data Governance Act, Data Act, Data Spaces, Database Directive, OpenData Directive
4. Future challenges in data protection
Through lectures by expert guests, real-life case studies and synchronous and asynchronous discussions
Week 12
III. Data security and cybersecurity
1. Risk assessment, compliance and data breach management
2. From NIS to NIS2
3. The National Cybernetic Perimeter and the institution of the National Cybersecurity Agency
Through lectures by expert guests, real-life case studies and synchronous and asynchronous discussions