Legal Issues in Data Science: Lecture Notes

Typeset lecture notes for Legal Issues in Data Science, University of Pisa, academic year 2025/26. The notes cover the legal side of data science: algorithmic ethics and data mining, the EU AI Act, the GDPR and data protection, and data governance for non-personal data. Written by a computer scientist with no legal background: a practical, operational guide for someone crossing over into the law.

⚠️ Disclaimer. Derived from the Legal Issues in Data Science course materials (Academic Year 2025/2026), MSc in Data Science & Business Informatics, University of Pisa.

These notes are open educational content created by a student. They are not an academic source and may contain inaccuracies. You may freely share, modify, and reuse this material for educational and non-commercial purposes with appropriate attribution. The content is my personal interpretation of the professor's course materials and should not replace official teaching resources. I assume no responsibility for any errors or misinterpretations.

These notes were produced with an AI-in-the-middle workflow: a first human pass, then Claude Code to support formulation, understanding, and rewriting, followed by a final human review.

If you find errors, have suggestions, or spot unintentionally included copyrighted material (which I will promptly remove on notification), contact me at sclfnc@proton.me.

This course is part of the MSc Data Science lecture notes collection (University of Pisa), one repository per course. Clone the whole set with git clone --recursive.

Layout

• main.tex: entry point, in the folder root; identical across the whole notes collection (it only loads the shared preamble and the course file).
• src/housestyle.tex, shared house style: geometry, colors, section and ToC formatting, running heads, and the math environments (theorem, definition, …).
• src/common-preamble.tex: the shared package set, identical across courses.
• src/course.tex, everything specific to this course: title metadata, the Lato sans headings, the normref box for boxing a normative reference (article / regulation), hyperref/cleveref, and the \input{sec/...} list.
• sec/NN_*.tex: section files (the body of the notes), pulled in by course.tex: 01_etica, 02_aiact, 03_gdpr, 04_governance.
• img/fig_*.tex: one TikZ figure per file (each a figure float), \input by the section that references it.
• lids-notes.pdf: the compiled notes, in the folder root.
• No \bibliography: sources are cited inline in the prose, so there is no active bibliography (the folder still carries a references.bib, but no section uses \cite).
• No raster images: every figure (timelines, flow diagrams, role graphs) is native TikZ. Each diagram lives in its own file under img/ and is pulled into a section with \input{img/fig_slug.tex}; the file is a full figure float, so the diagram carries a caption and a \label and is cross-referenced with \cref.

Build

The notes use cleveref (which needs a final pass for cross-references) but no bibliography backend. Build from the folder root:

latexmk main.tex

latexmk runs pdflatex as many times as needed. The compiled PDF is named lids-notes.pdf; it and all auxiliary files (.aux, .log, .toc, .bcf, .bbl, …) land in the folder root and are git-ignored (listed in .gitignore). A .latexmkrc in the folder sets this up (it fixes the output name via $jobname). To do it by hand instead:

pdflatex -jobname=lids-notes main && pdflatex -jobname=lids-notes main

(the second pass resolves the table of contents and cross-references). Requires a standard TeX Live installation. Alternatively, upload the folder to Overleaf (New Project → Upload Project), set main.tex as the main document, and compile.

Credits

Written by Francesco Secoli, revised with the help of Claude Code: the course slides and lectures were transcribed and refined into LaTeX, then reworked into standalone notes. Based on the Legal Issues in Data Science course (a.y. 2025/26), University of Pisa. Contributions welcome: open an issue or a pull request.

Contents

The notes are four sections, in reading order:

#	Section	Topics
1	Algorithmic Ethics and Data Mining	Classification and the surveillance society, cross-contextual data flows, identity and nudging, the right to diverge, algorithmic bias and proxies, the European legal response, transparency / accountability / traceability
2	The EU Artificial Intelligence Act	History of AI regulation (soft law → binding law), Act overview and structure, provider vs deployer, prohibited practices, high-risk systems, provider and deployer obligations, FRIA, general-purpose AI models, the risk-based approach, penalties, the responsibility and liability gap
3	GDPR and Data Protection	European data strategy and the data economy (five Vs), regulatory instruments and the European data space, accountability and compliance, classes of data (personal, sensitive, pseudonymised, anonymised), controller / processor / joint controllership, the risk-based approach and DPIA, lawfulness and consent, data-subject rights, penalties, case-analysis method
4	Data Governance and Non-Personal Data	Constraints on circulation, instruments on non-personal data (Free Flow, Open Data, DGA, Data Act), data altruism, reuse in research and the FAIR principles, reproducibility vs replicability, the data management plan and open licences, governance roles, the Digital Services Act (four tiers, obligations, enforcement), dark patterns