AI AND DATA PROTECTION LAW

The course aims to provide students in the Global Law, Business & Tech Major with advanced knowledge of the legal, regulatory, and institutional frameworks governing data protection, data governance, and artificial intelligence, with particular focus on the European Union regulatory model and its interaction with global legal, economic, technological, and geopolitical developments. The course seeks to broaden the professional outlook of students by illustrating how legal expertise in data protection and AI regulation may be applied not only to the interpretation and enforcement of rules, but also to the design of compliance strategies, the assessment of technological risks, the governance of data-driven business models, and the evaluation of the legal implications of emerging AI systems. Particular attention is devoted to the GDPR, EU data regulations, platform regulation, the AI Act, and comparative approaches to data and AI governance in the United States, China, and international organisations. From this perspective, students are trained to understand the interaction between technological innovation, fundamental rights, market dynamics, organisational compliance, and public regulation in a transnational legal environment. Lectures provide the theoretical, legal, and institutional framework for the main topics covered in the course, including EU digital and data strategies, the GDPR, data sharing and data governance instruments, platform regulation, AI definitions and regulatory models, the AI Act, synthetic data, agentic AI, AI supply chains, and the use of data and AI in armed conflicts and military contexts. Seminars, case studies, group work, compliance-oriented exercises, and project presentations enable students to apply the knowledge acquired to concrete legal and organisational problems, while developing analytical, comparative, argumentative, risk-assessment, project-design, communication, and collaborative skills consistent with the interdisciplinary profile of the Global Law, Business & Tech Major of the Bachelor’s Degree in Global Law.

None.

Knowledge and understanding: By the end of the course, students will understand the legal, institutional and comparative foundations of data protection, data governance and AI regulation, with particular reference to the EU framework and its global implications. They will be familiar with the principles and main mechanisms of the GDPR; international data transfers; the Data Act; the Data Governance Act; the Database and Open Data Directives; the Digital Services Act; the Digital Markets Act; and the AI Act. They will also understand their relationship with fundamental rights, market and platform regulation, organisational compliance, digital sovereignty, and developments including synthetic data, foundation models, agentic AI and AI infrastructures. Applying knowledge and understanding: Students will be able to analyse issues arising from the processing, sharing and use of data and the development, deployment and governance of AI systems. They will identify the applicable framework, roles and responsibilities, obligations and risks, and interactions among data protection, data governance, platform regulation and AI regulation. Through seminars, cases, exercises and group work, they will apply legal reasoning to GDPR compliance, international transfers, data sharing, big-data analytics, automated decision-making, AI Act compliance, synthetic data, agentic AI, AI supply chains, and military uses of data and AI. Making judgements: Through interactive lectures, seminars, case discussions and group work, students will develop critical judgements on the legal, economic, technological, ethical and geopolitical implications of data and AI regulation. They will assess the strengths, limits, practical effects and enforcement challenges of the GDPR, the EU Data Strategy and the AI Act, as well as tensions between innovation and regulation, fundamental rights and market interests, accountability and technological development, and digital sovereignty and global interoperability. They will also evaluate risks relating to profiling, algorithmic bias, opacity, autonomous systems, AI infrastructures and armed conflict. Communication skills: Students will communicate clearly, rigorously and persuasively on data protection, data governance and AI regulation. They will present complex legal issues, explain regulatory implications for institutions, companies and technology providers, justify legal and compliance assessments, and use specialist EU digital-regulation terminology appropriately. They will prepare concise, well-structured analyses, reports and group-project outputs for academic, institutional, professional and multidisciplinary audiences. Learning skills: Students will independently navigate legislation, case law, institutional and policy documents, comparative frameworks, case studies and specialist literature on data protection, data governance and AI. They will update their knowledge in response to legal, institutional and technological developments, pursue further research, and integrate legal, technological, comparative and policy perspectives in addressing complex problems. Transferable skills: The course develops legal, analytical, digital and comparative competences for governing data-driven and AI-based technologies in global legal and business environments. Practical cases, seminars, group work and presentations strengthen risk assessment, problem-solving, project design, collaboration, argumentation, communication and ethical reasoning. Students will learn to work across legal, technological and organisational domains, assess the implications of innovation for rights, markets, institutions and society, and contribute to responsible digital governance in professional, institutional and international settings.

1. EU data protection and data governance framework: The course examines the evolution of EU digital, data and AI strategies, with specific focus on the GDPR, data protection principles, data subject rights, governance of personal data processing, international data transfers, and the role of compliance tools such as DPIAs, accountability mechanisms, and data protection by design and by default. 2. Regulation of data sharing, platforms and digital markets: The course analyses the main EU regulatory instruments concerning data access, re-use and sharing, including the Data Act, the Data Governance Act, the Database Directive and the Open Data Directive. It also addresses the Digital Services Act and the Digital Markets Act, highlighting the intersections between data protection, platform governance, competition law and digital market regulation. 3. AI regulation, compliance and emerging technological developments: The course explores the legal definition and governance of AI, the EU AI Strategy and the structure of the AI Act, including risk classification, obligations for high-risk AI systems, compliance mechanisms and critical issues. It also covers the interplay between AI and data, synthetic data, agentic AI, foundation models, AI infrastructures, gigafactories and supply chains. 4. Comparative, geopolitical and security dimensions of data and AI: The course adopts a global and comparative perspective on data and AI regulation, comparing EU, US, Chinese and international approaches. It also addresses the use of data and AI in armed conflicts and military contexts, with attention to international humanitarian law, surveillance, targeting, autonomous weapons systems, accountability and strategic dependencies.

The main study materials for the course consist of the lectures, the slides, and the additional materials shared by the Professors on the MyLuiss platform. These materials constitute the primary basis for the preparation of the exam for attending students. The following reference texts are recommended for all students and are compulsory for non-attending students: European Union Agency for Fundamental Rights and Council of Europe, Handbook on European Data Protection Law, Luxembourg: Publications Office of the European Union, 2018, available at: https://fra.europa.eu/sites/default/files/fra_uploads/fra-coe-edps-2018-handbook-data-protection_en.pdf Nathalie A. Smuha, ed., The Cambridge Handbook of the Law, Ethics and Policy of Artificial Intelligence, Cambridge: Cambridge University Press, 2025.

Learning: lectures Practice: expert guests, case studies and simulations Discussion: seminars and in-class group discussions Collaboration: small-group work, discussion of others’ findings and development of shared outcomes Production: reports and presentations

Achievement of the intended learning outcomes set out in the course objectives will be assessed and verified as follows: 75% of the final grade will be based on participation in, and contribution to, group work. The group project will consist of the development of an AI Agent specialised in the management of legal issues relating to AI and data, on the basis of the specific legislation, case law and regulatory framework of a non-EU jurisdiction. The procedures for carrying out, developing and presenting the group work will be explained and supervised during the course, with the contribution of industry professionals. 25% of the final grade will be based on the discussion, during the oral examination, of an individual thematic in-depth study chosen by the student on one of the topics covered in class. This discussion will assess the student’s ability to analyse a specific legal or regulatory issue, use appropriate sources, develop a coherent argument and communicate the results clearly and rigorously. Non-attending students will be examined orally on the teaching materials and the reference textbooks indicated in the syllabus.

Interest in the subject matter and individual appreciation of the Chairs.