European Data Protection and Privacy Law

Faculty of Law

European Data Protection and Privacy Law

Full course description

Privacy and data protection are the fundamental rights that have gained salience not only as values protected within the European multi-level human rights protection system, but also as rights and obligations that provide framework for activities of entities using data as a basis for their economic activities (as if it were, in a slightly dated and over-used terms, ‘new oil’). This means that data protection as a discipline is complementary to data management and lies at the intersection with other major disciplines of law, both applying to private and public actors. What is more, it seems that the regulatory paradigm underlying GDPR has become a blueprint not only for data protection laws worldwide, but also for the legislative attempts to ensure ethical and fundamental rights compliant development of new technologies. The Digital Services Act or the proposal for the future AI Regulation only herald European Union’s ‘Digital Decade’ (https://digital-strategy.ec.europa.eu/en/policies/digital-compass) importance of which has been underlined by the radical change of our work-and lifestyles during the past years’ Covid-19 pandemics and through the employment of cyberwarfare in the course of 2022 Russian-Ukrainian war.

With the above in mind, during European Privacy and Data Protection Law course we will explore the European privacy and data protection system presenting it against the inter-disciplinary background and, subsequently, in the context of international and comparative law.

The course will begin with exploration of the GDPR-based architecture of data protection from three perspectives:

that of data controllers, which are tasked with principle-compliant data processing, with assessing and mitigating risks emerging from data processing operations and with ensuring the rights of data subjects;
that of data subjects, who derive rights and protection from the European Union data protection framework; and, finally,
that of supervisory authorities who oversee the compliance with data protection principles. Subsequently, the optics will be expanded taking a comparative (ECHR, other jurisdictions) and intra-disciplinary (data retention, law enforcement, etc.) perspective.

In preparation for the course students are offered a brief introductory module on Canvas providing the background information on the intersection of law, technology and economics.

Method

The course is based on the mix of lectures and tutorials delivered in the spirit of problem-based methodology.

Lectures offered by course coordinator will be complemented by guest lectures delivered by University of Maastricht and European Centre on Privacy and Cybersecurity (ECPC) scholars offering a variety of perspectives on the topic of the course.

Course objectives

The aims of this course are to acquire:

Basic knowledge of European privacy and data protection law and the way it positions itself vis-à-vis other legal systems and disciplines;
Fundamental knowledge of the architecture of the European Union data protection laws, in particular, the General Data Protection Regulation (Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) and the Directive on Data Protection for Prevention of Criminal Offences (Directive 2016/680 on the protection of natural persons with regard to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, and on the free movement of such data);
The awareness of the interplay of the European Union data protection rules with other fundamental rights and legal instruments;
Knowledge and understanding of the basic construction of the ECHR based protection of the right to private and family life;
Understanding of core notions of EU privacy and data protection law, such as data subject, data controller and processor, accountability, legal bases for data processing, explicit consent, sensitive data, data protection impact assessment, anonymisation and pseudonimization, rights of data subjects, including the right to be forgotten, enforcement and fines;
Awareness of the variety of rights and obligations stemming from the GDPR, but affecting not only individuals’ experience and execution of the right to data protection and privacy, but also the organisation of enterprises and the function of public authorities in this context.
Awareness of the functioning of GDPR regulatory paradigm and methodologies of compliance stemming from it.
Awareness of the impact of GDPR on other areas of technology regulation.
Skills to ensure compliance ranging from the adapting of existing tools to engaging in discussion across disciplines in order to obtain a full privacy-related picture of organization’s activities.

Prerequisites

It is not a prerequisite for attending the course but an advantage if students have the knowledge of the basics of the European multi-level system of human rights protection. If this basic knowledge is lacking, assistance will be provided for additional self-study aimed at complementing the basic knowledge.

In addition, understanding of basics of data-based technology will assist students in understanding the implications of data protection related challenges and consequences of not addressing them. In order to aid students in obtaining knowledge on the area, Module 0 of the course is offered to them in Canvas environment.

European Data Protection and Privacy Law