LL222      Half Unit
Data Law and Policy

This information is for the 2025/26 session.

Course Convenor

Availability

Requisites

Additional requisites:

Whilst there are no formal pre-requisites, students are recommended to complete LL220 Technology, Law and Regulation before taking this course.

This course will examine the role data plays in society: it is an indispensable input for artificial intelligence and other digital tools. Data is therefore an economic asset. It is also a source of power as inferences and predictions based on data shape individual and collective decisions and opportunities. Data laws seek to regulate the use of data to achieve an ‘appropriate’ balance between the various and interests that its usage engages. The course will use EU legislative instruments as its starting point, but the legal and policy issues identified and debated are of global significance.

This course will proceed in three parts: (1) An introduction to the data law and policy landscape by highlighting the role played by data in society and the technological changes that have increased its salience before introducing the key concepts in data law and policy, (2) an examination of the core structure of data protection laws worldwide and evaluate critically the capacity and limits of data protection to regulate AI, and (3) an exploration recent developments in data law and policy, focusing on initiatives that complement or replace data protection laws. 

An indicative list of topics includes:

• Introduction: Data as an Asset, Data Protection as a Right
• Introduction: The Legal Distinction between Personal Data and non-Personal Data
• Data Protection: Fair Data Processing and Consent
• Data Protection: Fair Data Processing beyond Consent
• Data Protection: Individual Rights – The Right to be Forgotten
• Data Protection: Attributing Responsibility for Data Processing
• Data Protection as a Tool to Regulate AI
• Data Governance: Data Ownership
• Data Governance: Data Intermediaries and Trusts
• Data Governance: Future Challenges 

20 hours of seminars in the Winter Term.

This course has a reading week in Week 6 of Winter Term.

Essay (1500 words)

1. Andrew Murray, Information Technology Law: Law and Society, 5ed, Ch.22 and 23
2. Lee A. Bygrave, Information Concepts in Law: Generic Dreams and Definitional Daylight, (2015) Oxford Journal of Legal Studies, 35 (1), 91.
3. Nadya Purtova, ‘The law of everything. Broad concept of personal data and future of EU data protection law’, (2018) Law, Innovation and Technology, 40.
4. Michal Gal and Orla Lynskey, ‘The Legal Implications of Synthetic Data’, (2024) Iowa Law Review 109, 1087  
5. Damian Clifford, Megan Richardson and Normann Witzleb, ‘Artificial Intelligence and Sensitive Inferences: Protecting Sensitive Personal Data in the Age of Anxiety’, in Regulatory Insights on Artificial Intelligence: Research for Policy, Findlay, Ford, Seoh and Thampapillai (eds.) (Edward Elgar, 2022).
6. Ada Lovelace Institute and UK AI Council, “Exploring legal mechanisms for data stewardship”, Report, March 2021.

Exam (100%), duration: 150 Minutes in the Spring exam period