Data Protection Legislation & Ethics
As society becomes increasingly data-driven, understanding the regulatory and ethical implications of emerging technologies, particularly AI and data analytics, is crucial for shaping the future. This course aims to equip students with the knowledge and tools needed to navigate the complex legal frameworks surrounding information technologies. From the ethical challenges posed by artificial intelligence to the legal obligations under EU regulations, students will explore how technology intersects with key principles like transparency, fairness, and accountability.
The course encourages students to critically engage with real-world scenarios and legal cases, fostering an understanding of how data-driven technologies impact society. Through case studies, students will analyse the risks and benefits of these technologies and apply risk assessment frameworks to propose ethically and legally sound solutions.
Students will be expected to produce written assignments, engage in group discussions, and conduct activities on AI regulation and ethical governance. This will include examining EU regulatory tools such as the AI Act and evaluating the implications of emerging tech on privacy, non-discrimination, and safety. The course aims to build both legal insight and ethical sensitivity toward developing and deploying responsible technologies.
Important Notice on Course Suitability and Activities:
Some Summer School courses are designed for students with prior academic background in a specific discipline and may be unsuitable for participants without that preparation.
In addition, certain courses include discipline-standard practical activities (for example, laboratory work with biological specimens, dissections, use of clinical or forensic material, field sampling, or other hands-on procedures) that may be unfamiliar or unsettling for some participants.
Students are responsible for reading the course descriptor carefully and ensuring (i) that they meet any stated academic expectations or prerequisites, and (ii) that they are comfortable participating in the methods and activities described.
If you are unsure about suitability, please contact the course lecturer(s) before enrolling.
| Week | Contents | Teaching / learning activities |
|---|---|---|
| 1 | Internet Regulation |
Origin, evolution and future of new technologies, Regulation of online content in the EU, Liability of intermediaries, Legal regime of ISPs, audiovisual services and telecommunications services. . |
| 2 | Data Protection and privacy laws |
Privacy vs security, An overview of the GDPR and its provisions, international data transfers, intellectual property rights, Cybercrimes |
| 3 | AI regulation | Notes on the new Artificial Intelligence Act, IA and data protection, Comparative analysis of IA legislations, AI ethical impact assessments, the future of IA |
From Monday to Friday.
From 9 a.m. to 12:45 p.m.
The evaluation will consist of 5 different activities:
- Three assignments to be conducted and submitted in class (20% each) at the end of each week
- Submission of all class activities (20%)
- Attendance and participation in class (20%).
The dates for the 3 assignments are 17 July, 24 July, and 30 July 2026.
Students who for justifiable reasons have not been able to submit one of the three assignments on the specific date, may have the possibility to do an extra activity under the criteria indicated by the lecturer. The conditions of eligibility for this extra activity are strict and decided on a case-by-case basis. A student who cheats or tries to cheat in an exam will be given a 0. A student who submits a paper or a practical exercise in which evidence of plagiarism can be identified will be givenAcademic integrity notice: any form of plagiarism in work submitted for this course will be treated as a serious academic offence and may result in an automatic fail grade. a 0 and will receive a warning. The material and language of the course is English.
Academic integrity notice: any form of plagiarism in work submitted for this course will be treated as a serious academic offence and may result in an automatic fail grade.
-
Regulation (EU) 2024/1689 of the European Parliament and of the Council on Artificial Intelligence (Artificial Intelligence Act) and amending certain Union legislative acts
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- European Data Protection Board (2020). Guidelines 05/2020 on consent under Regulation 2016/679 (Version 1.1).
- IEEE, Ethically Aligned Design: A Vision for Prioritizing Human Well-being with Autonomous and Intelligent Systems
- High-Level Expert Group on AI, Ethics Guidelines for Trustworthy AI
- Mantelero, Alessandro (2018): “AI and Big Data: A blueprint for a human rights, social and ethical impact assessment”. Computer Law & Security Review, vol. 34, Issue 4, pp. 754- 772.
- Blasi Casagran Cristina (2016): Global data protection in the field of law enforcement: An EU perspective, Routledge. Taylor & Francis Group, Oxfordshire, UK, June 2016. ISBN-10: 1138655384.
- Savin, Andrej (2013): EU Internet Law, Editorial Elgar European Law, Glos (UK), 2013.
Besides this bibliography, the lecturer will provide other appropriate and up-to-date resources, along with legal and soft-law texts. In addition, the lecturer will indicate what pieces are of obligatory reading and study, and what are recommendable.
Links web:
- Handbook on European Data Protection Law
- European Data Protection Supervisor
- Spanish Agency of Data Protection
- Spanish Institute of Cybersecurity
- Barometer Centro de Investigaciones Sociológicas
- Spanish Cryptologic Centre
- E.Signature Portal
- Spanish Cybersecurity Law
- Spanish Security Scheme
- WIPO portal
- PCI DSS Law (e-payment)
- ISO 27001 Law
Dr Cristina Blasi is an Associate Professor at the Autonomous University of Barcelona (UAB). She is a researcher and professor of EU Law, Digital Law, and Public Participation in EU institutions at the UAB. After graduating in Law in 2007, she completed a master’s degree in EU Integration (Barcelona, 2008), a master’s degree in EU Law (Saarland, 2009), and a master’s degree in Comparative, European, and International Law (Florence, 2011). She obtained her PhD in Law from the European University Institute (Florence, 2015), specializing in EU law on privacy and data protection. In terms of her professional experience, she completed paid internships at the Legal Service of the European Commission (2010), the European Data Protection Supervisor (2012), and Europol (2013). Dr. Blasi has over 10 years of experience teaching undergraduate and graduate students at several universities and is the coordinator of the H2020 project “IT Methods and Tools for Migratory Flow Management” (ITFLOWS) and the Research Group “GLOBAL Security, Technology and International Law” (GLOBAL INTEL).
- E-mail: cristina.blasi@uab.cat
Eduard Blasi Casagran is a digital lawyer and partner at Data Guardians. He holds a law degree from the Autonomous University of Barcelona. He has collaborated with the Catalan Data Protection Authority, the Andorran Data Protection Agency, and the European Data Protection Supervisor. He has also worked for several years in the private sector on issues related to new technologies, digital law, and AI. He has extensive experience in the pharmaceutical and eHealth sectors, where he has developed much of his professional career. He is also the Third Vice President of the Spanish Professional Association of Privacy (APEP), a lecturer, and a disseminator on the TechAndLaw channel (AEPD Award 2023).