DATA MANAGEMENT AND LEGAL ISSUES

The course contributes to the interdisciplinary objectives of the MA in Digital and Public Humanities by providing the legal literacy required to identify and assess the principal legal issues arising in the design, management, and evaluation of digital projects involving databases, digitised collections, research datasets, licensing arrangements, cloud services, and artificial intelligence tools. It supports the Degree Programme’s focus on the digital management, enhancement, and dissemination of cultural resources by enabling students to identify the legal conditions under which data and digital content may be collected, processed, shared, reused, preserved, and made available to the public.

1. Knowledge and understanding
1.1. Identify and explain the principal legal categories governing data, information, personal data, databases, digital content, and AI systems.
1.2. Explain the structure and interaction of the main EU instruments relevant to data-intensive projects, including the GDPR, the Data Governance Act, the Data Act, the Digital Single Market Copyright Directive, and the AI Act.
1.3. Explain how contracts, institutional policies, technical and organisational measures, and regulatory guidance contribute to the implementation of legal requirements.

2. Applying knowledge and understanding
2.1. Identify the legal framework applicable to a digital project and connect factual circumstances to the relevant legal rules and institutional instruments.
2.2. Read and interpret selected provisions of EU legislation, CJEU judgments, and standard contractual documents with appropriate precision.
2.3. Recognise the principal legal risks arising in digitisation, research data management, data sharing, open licensing, cloud services, and AI procurement or deployment.

3. Making assessments
3.1. Distinguish settled legal requirements from interpretative uncertainty, legislative reform, soft law, and non-binding model clauses.
3.2. Assess how rights, responsibilities, risks, and remedies are allocated among cultural institutions, researchers, data subjects, technology providers, cloud vendors, and data recipients.
3.3. Formulate legally relevant questions and identify matters that require specialist advice or institutional review.

4. Communication skills
4.1. Use the principal concepts and terminology of EU digital law accurately in English.
4.2. Present a structured legal analysis of a factual scenario, identifying the applicable framework, material obligations, and unresolved issues.
4.3. Communicate effectively with legal advisers, data protection officers, rights managers, and institutional decision-makers.

5. Learning skills
5.1. Locate and use authoritative EU legal sources and institutional materials.
5.2. Monitor relevant regulatory developments and assess how changes in the applicable framework affect the legal analysis of a digital project.

The course does not presuppose previous legal studies. Introductory guidance on legal concepts, terminology, and the reading of legal sources will be provided through Moodle and during the opening part of the course.

1. The legal architecture of data. EU legal sources; the distinction between data and information; personal and non-personal data; raw, inferred, aggregated and co-generated data; metadata, mixed datasets and data flows; institutional data inventories; legal positions and the limits of the concept of data ownership; the EU data strategy and selected comparative perspectives concerning the United States and China.
2. Privacy and data protection. The development of privacy and data protection; the GDPR’s scope, principles, lawful bases, special categories of data, data subject rights, accountability, privacy by design and by default, anonymisation and pseudonymisation, research and archiving safeguards, Data Protection Impact Assessments, Data Processing Agreements, privacy notices, security obligations, and international data transfers.
3. Intellectual property in the digital environment. Copyright, originality, authorship, first ownership, public-domain digitisation, rights clearance, database protection, text and data mining, cultural heritage exceptions, orphan and out-of-commerce works, open access, Creative Commons licensing, research data, and selected questions concerning AI-generated content and AI training.
4. The contractual governance of data. The controller-processor relationship; Standard Contractual Clauses; the Data Governance Act and European data spaces; the Data Act; access, use, and sharing of data; data markets and asymmetries in data transactions; unfair contractual terms; data intermediaries; cloud switching and exit; model contractual terms; data-sharing due diligence; security, audit, liability, termination, and deletion or return of data.
5. AI regulation and institutional governance. The AI Act’s risk-based structure; prohibited practices; high-risk systems; general-purpose AI models; provider and deployer obligations; transparency, human oversight, AI literacy, and regulatory sandboxes; the relationship between the AI Act, the GDPR, copyright, and contract law; responsible data stewardship and institutional accountability; procurement and review of AI vendor terms in cultural and research institutions.
Across the five areas, students will work with scenarios drawn from digital archives, cultural heritage institutions, research datasets, digital publishing, cloud services, and AI-assisted tools. The precise selection of cases and materials may be updated on Moodle in light of legal and institutional developments.

The following doctrinal, legislative, judicial, institutional, and professional materials constitute the reference texts for the course. Where only selected parts of a source are assigned, the relevant chapters, provisions, or extracts are specified below.
E. Longo, A. Pin and F. Viglione (eds.), Data Protection in Context: Between Privacy and AI, Giuffrè, 2025. Chapters 1–3, 5–12, 14, 16, 19 and 21; selected extracts from Chapters 15, 18, 20 and 22.

European Union Agency for Fundamental Rights and Council of Europe, Handbook on European Data Protection Law, 2018 updated edition, Chapter 1; Chapter 2, sections 2.1–2.3; Chapter 3; Chapter 4, sections 4.1–4.3; and Chapter 6.

J. Pila and P. Torremans, European Intellectual Property Law, Oxford University Press, latest edition, selected extracts from Part I, sections 2–3, and Part III, sections 1–2. The extracts will be available through Moodle or University library resources; purchase of the volume is not required.

WIPO, Generative AI and IP: A Factsheet, 2024.

Primary EU legislation: Regulation (EU) 2016/679 (GDPR), Articles 2–50; Regulation (EU) 2022/868 (Data Governance Act), Articles 1–10 and 16–25; Regulation (EU) 2023/2854 (Data Act), Articles 2–15, 23–35 and 41–44; Directive (EU) 2019/790, Articles 2–7 and 15–17; Directive 96/9/EC, Articles 1–11; Regulation (EU) 2024/1689 (AI Act), Articles 1–6, 9–15, 50 and 57–63, and Annexes I and III; Commission Implementing Decision (EU) 2021/914.

Institutional materials: European Commission, A European Strategy for Data, COM(2020) 66 final, selected extracts; European Commission materials on model contractual terms for data access and use and standard contractual clauses for cloud computing contracts under the Data Act; EDPB Statement 4/2025 on the Commission’s draft model contractual terms; and European Parliament and European Commission materials on the implementation of the AI Act.

Selected CJEU judgments: Case C-131/12, Google Spain; Case C-311/18, Schrems II; Case C-5/08, Infopaq; Case C-145/10, Painer; Case C-683/17, Cofemel; and Case C-401/19, Poland v Parliament and Council.

Professional and standard-form materials provided by the instructor, including Data Processing Agreements, Data Protection Impact Assessment materials, privacy notices, Creative Commons licences, Standard Contractual Clauses, Data Act model contractual terms, and selected extracts from data-sharing, cloud-service, and AI vendor contracts.
The study of the primary EU legal materials and the professional documents assigned for each topic is an integral part of the course.

The final examination is a written test in English consisting of two open-ended, scenario-based questions. The maximum time allowed is 75 minutes. Each question is worth up to 15 points, for a total of 30 points.
Each answer is assessed according to the following criteria:
1. Identification and accurate understanding of the applicable legal framework: up to 5 points.
2. Application of the relevant rules to the facts and quality of legal reasoning: up to 4 points.
3. Ability to identify connections among legal instruments, contractual arrangements, and institutional responsibilities, including unresolved issues: up to 3 points.
4. Clarity, logical structure, and appropriate use of English legal terminology: up to 3 points.

The examination therefore assesses the student’s ability to move from factual circumstances to legal classification, from classification to applicable obligations, and from those obligations to a reasoned assessment of risks and possible courses of action.

Students who take part in the optional contract-annotation workshop, legal-risk memorandum, or an equivalent activity announced at the beginning of the course may obtain up to three additional points. The bonus is awarded as follows: up to 1 point for preparation and engagement with the assigned materials; up to 1 point for the quality of legal analysis; and up to 1 point for clarity and effectiveness of the contribution. The bonus is applied only after the written examination has reached the passing threshold and cannot raise the final mark above 30/30. Optional activities do not replace the written examination.

Honours may be awarded only to students who obtain 30/30 in the written examination and demonstrate outstanding command of the applicable legal framework, analytical depth, independent judgement, and exceptional clarity. Additional points obtained through optional activities cannot give rise to the award of honours.

written

The instructor is responsible for ensuring the authenticity and originality of all examinations and coursework. In cases of suspected academic misconduct, an additional on-site assessment may be required during the exams, which may differ from the standard format.

The final mark is expressed on a scale of 30. The minimum passing mark is 18/30.
Below 18: insufficient knowledge of the applicable legal framework; material errors in legal classification; inadequate application of rules to the facts; or answers lacking sufficient structure and clarity.

18–22: sufficient knowledge and applied understanding of the course content; basic ability to identify the relevant legal issues and apply the principal rules; sufficient structure and use of legal terminology.

23–26: satisfactory to good knowledge and applied understanding; sound legal classification and reasoning; appropriate identification of connections among the relevant rules and instruments; clear and generally accurate written expression.

27–30: very good to excellent knowledge and applied understanding; precise and well-developed legal reasoning; strong ability to identify interactions, risks, and unresolved questions; fully appropriate structure and legal terminology.

30 with honours: outstanding and comprehensive performance in the written examination, demonstrating excellent command of the legal framework, independent judgement, analytical depth, and exceptional clarity of expression. Honours cannot be awarded solely on the basis of points obtained through optional activities.

The course comprises 30 hours of on-campus teaching. It combines lectures with guided reading of primary legal sources, analysis of case law, discussion of professional scenarios, and annotation of standard legal and contractual documents. The sequence moves from the legal classification of data to data protection, intellectual property, contractual data governance, and AI regulation.

The comparative dimension is integrated into selected parts of the course through references to the United States and China. These references are used to examine how different legal systems translate fundamental-rights, market, technological, and institutional priorities into regulatory and contractual choices.

The course includes at least one optional applied activity, which may take the form of a contract-annotation workshop, a short legal-risk memorandum, or a structured classroom discussion. Guest speakers with professional experience in data protection, cultural institutions, digital publishing, or technology contracting may contribute to selected sessions. Materials required for each class will be indicated on Moodle.

The legal framework examined in the course is subject to continuing implementation and interpretation. Moodle will identify the versions of the primary texts, case law, institutional guidance, and contractual materials relevant for class preparation and assessment. The selection of cases, examples, and supplementary materials may be updated to reflect material legal or institutional developments, without altering the course’s core contents, expected learning outcomes, or assessment methods.

Accessibility, disability and inclusion. Students with disabilities or specific learning disabilities may request support and reasonable accommodations through Ca’ Foscari’s Inclusion Service. Information on the available services and applicable procedures is provided on the University website. For further information, students may contact inclusione@unive.it.

This subject deals with topics related to the macro-area "Circular economy, innovation, work" and contributes to the achievement of one or more goals of U. N. Agenda for Sustainable Development