JUR-3625 Data Protection Law - 15 stp

The technological developments make it possible to process data in ever-increasing complex and efficient ways. This has caused an increased focus on legal protection of personal data. Data protection law is a rapidly developing field, which involves a multitude of international legal instruments. The pace of technological change, automatic data processing and the digitization of society, mean it is assuming an increasingly critical role in our lives today. It regulates everything from legal responsibility for cyber-security breaches, to how social networking sites store and share data and even how its users share information about one another or others. Personal data is becoming a valuable asset. Data protection law seeks to strike a balance between protecting the rights of individuals, whilst also facilitating the movement and use of data by organisations and states. A basic understanding of data protection law is now a necessary requirement for many lawyers and many companies are under an obligation to employ specialist Data Protection Officers.

This course studies legal rules on data protection which govern the processing of data relating to persons (personal data) in order to protect the privacy and related interests of those persons. The main focus is on the European legal instruments, primarily the European Union (EU) General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR. The course, however, offers a broad introduction to data protection law, and a more specific focus on selected key substantive topics, particularly in the context of distributed computer networks, such as the Internet. Hence, themes such as legal-regulatory issues related to surveillance and the increasing automatization of decision-making processes will be addressed.

The course consists of three main parts. The first part of the course introduces the basic concepts, principles and instruments of data protection law at a European level and includes the historical background and development of data protection law within the EU and the Council of Europe (CoE). The second part of the course deals with data protection as a human right with a focus on the EU Charter for Human Rights (Articles 7 and 8), and the European Convention on Human Rights and Fundamental Freedoms (ECHR) (Article 8), and case law illustrating the relationship between human rights and data protection regulation. The third part of the course focuses on the EU regulations and directives on data protection, such as the GDPR, the EU Privacy and Electronic Communications Directive (Directive 2002/58/EC), and the forthcoming E-Privacy Regulation, and the Data Protection Law Enforcement Directive (Directive (EU) 2016/680). The course studies the main rules and mechanisms of these legal instruments, including the principles governing the processing of personal data, the material and territorial scope of the relevant rules, the legal basis for processing, the rights of data subjects, transfer of personal data to third countries, and sanctions and control mechanisms. Attention is also given to data protection in the context of police and criminal justice and to data protection issues raised by the use of Artificial Intelligence, such as the legality of technologies involving automated individual decision-making and profiling.

From the course, one gains knowledge and understanding of the rules and principles for protecting privacy and personal information, particularly as laid down in the EU and the Council of Europe (CoE) instruments, and into the regulatory challenges in the field. A further aim of the course is not just to impart knowledge of the relevant legal rules as they currently stand, but also to encourage critical appraisal of them. This involves analyzing and challenging the assumptions upon which the rules are based and a critical analysis of the interaction between law and technology.

The course builds upon the students´ knowledge of international law and human rights acquired during their first and fourth year of study but entails no overlap with courses at the Faculty of Law.

Students should have basic knowledge of International and European law. For students on the integrated master´s degree programme in law in Tromsø, the course builds upon their knowledge of International law, European and Human Rights Law acquired during their first and fourth year of study. Students at the integrated master´s degree programme in law may choose this course as a partial fulfillment of the requirements for the elective part of the programme's fifth year, cf. Programme Specification for the Master's Degree in Jurisprudence at the University of Tromsø (Studieplan for graden Master i rettsvitenskap ved Universitetet i Tromsø), Sec. 4. Followed by necessary application and admission process, other students (such as exchange students) may also choose this course, cf. Regulations for the Elective Component in the Master's Degree Programme in Jurisprudence (Reglement for den valgfrie delen av masterstudiet i rettsvitenskap) (Regulation). Students who do not have admission to the Master of Law-studies at the Faculty of Law must contact the Faculty for information about required qualifications and application process for this course.

Knowledge: Having passed the exam, the student shall have acquired:

• advanced knowledge of the rationale for legal protection of personal data;
• advanced knowledge of the basic concepts of data protection law
• advanced knowledge of the legal framework for data protection in the European Union (EU) and the Council of Europe (CoE);
• good knowledge of the interplay between data protection and human rights;
• good knowledge of the ways in which information and communication technology (ICT) and Artificial Intelligence challenge the application and enforcement of law on protection of personal data;
• knowledge of the sanctions and control mechanisms and the role of the European Data Protection Supervisor (EDPS);

Skills: Having passed the exam, the student is able to:

• understand thoroughly the rationale and logic of the law on protection of personal data;
• to understand the place of data protection law in the broader legal landscape;
• identify relevant data protection issues when such issues occur in a given situation
• identify and analyze questions regarding legal rules on protection of personal data in accordance with the generally accepted legal-dogmatic method;
• identify and discuss limits of the current law;
• use English terminology applicable to this field of law.

General Competence: Having passed the exam, the student can:

• apply the obtained knowledge and skills in the field of data protection law to new legal scenarios, tasks and projects, where relevant;
• analyze data protection law issues, to argue for different possible solutions to the legal issues and make a reasoned balancing of the relevant legal arguments;
• communicate reasoning in the field of data protection law in a clear and precise manner, orally and in writing to the academic community and the general public;
• identify and reflect on ethical dilemmas that may arise within the field and deal with these in a responsible manner;
• master the English language and terminology within this field of law.

Students are required to hand in a mid-term paper assignment, and have it accepted as adequate before they can take the exam. The paper shall not exceed 5 pages. The topic may be chosen freely by the students from the topics covered by the course. Before submission, all students will be given the possibility to present and discuss the paper within the class.

In assessing whether the research paper is approved, the following criteria will be used:

• Identification, formulation and discussion of the research question
• Critical and independent use of legal sources
• Presentation and communication of legal arguments in a clear and precise manner
• Knowledge within a particular topic within the course content.

The evaluation of whether the research paper is approved, is based on an overall assessment of these criteria.

The course is assessed through a six hours closed book written school examination where the student is allowed to bring a dictionary, as long as it merely provides translations and no definitions. The faculty must approve each student’s examination supports prior to the examination. The exam may include theoretical and/or practical scenario questions. The grading scale of A to F is applied, where F constitutes fail. Students who fail their examination are entitled to re-sit the examination, cf. Regulations for examinations at the University of Tromsø Sec. 22.

The date for the exam can be changed. The final date will be announced at your faculty early in May and early in November.