Acquis d'apprentissage visés
- Identify and apply legal obligations arising from the GDPR when designing and developing an IT system processing personal data
- Implement privacy by design and privacy by default principles in a software or application development project
- Conduct a Data Protection Impact Assessment (DPIA) and derive appropriate technical and organizational measures
- Identify intellectual property rights applicable to a digital creation and adopt best practices regarding the use of content generated or used by AI
- Analyze obligations imposed by the Artificial Intelligence Regulation (AI Act) based on the risk class of the developed system and align them with GDPR requirements
- Adopt an ethical and responsible stance in the practice of computer engineering, integrating legal dimensions from the design phase
Prérequis
- Expected transversal skills:
- General knowledge of how a computer system, a web application and a mobile application work
- Basic understanding of data processing and storage (databases, APIs, cloud services)
- Ability to read and analyze regulatory texts and official documents
- Proficiency in written French for drafting legal and technical documents
- Curiosity about societal, ethical and legal issues in digital technology
Programme
- Introduction to Digital Law:
- Hierarchy of norms in France; integration of European law (directives and regulations).
- Overview of the legal framework applicable to digital: GDPR, AI Act, intellectual property law.
- General Data Protection Regulation (GDPR):
- Fundamental definitions: personal data, processing, controller, processor, DPO, processing register, legal bases.
- Conditions for appointing a DPO; fundamental principles: lawfulness, purpose limitation, data minimization, accuracy, storage limitation, security and confidentiality.
- Consent: validity conditions, proof and right to withdraw.
- Data subject rights: access, rectification, erasure, portability, restriction, objection.
- Data Protection Impact Assessments (DPIAs / PIAs): definition, conditions for conducting, balancing of interests.
- Incident management: notification deadline to the CNIL, declaration conditions.
- Sanctions for non-compliance with the GDPR.
- Intellectual Property (IP) Law:
- International, European and national sources; distinction between economic rights and moral rights.
- Types: copyright, patent, trademarks, designs and models, geographical indications, trade secrets, e-Soleau envelope.
- Principles of exclusivity, temporality and territoriality according to the type of IP.
- Specific case of IP and AI: citation obligations, Creative Commons licenses (BY, NC, ND, SA), U.S. copyright, NFTs.
- Works created by AI: 100% AI creation vs shared AI/human creation; what about copyright?
- Best practices regarding AI: legal monitoring, contractual clauses, preference for licensed models.
- GDPR and Artificial Intelligence Regulation (AI Act):
- New European bodies: European AI Board, AI Office, Advisory Forum, Independent Scientific Panel of Experts.
- Classification of AI systems by risk level (AI Act) and implications for connected objects.
- Proportional application of the GDPR to data processing by AI.
- Obligations of AI system providers and users; CNIL recommendations on automated individual decision-making.
- Balancing act: competitiveness / GDPR compliance / respect for intellectual property.
- Practical case — to-do list for creating compliant AI: purpose, controller, legal basis, data minimization, retention period, data subject rights, privacy by design and by default, DPIA.
Modalités d'évaluation
Continuous assessments and evaluated practical work.
Bibliographie
- Gilles Vercken & Stéphane Leriche - Droit de l’informatique et des réseaux - Lamy, latest edition
- Jean Frayssinet - Informatique, fichiers et libertés - Litec
- CNIL - Practical GDPR Guide for Developers: <https://www.cnil.fr/en/gdpr-developers-guide>
- CNIL - Guide to the Security of Personal Data: <https://www.cnil.fr/en/personal-data-security>
- CNIL - Recommendations on the Development of AI Systems: <https://www.cnil.fr/en/artificial-intelligence>
- European Commission - General Data Protection Regulation (GDPR): <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679>
- European Commission - Artificial Intelligence Regulation (AI Act): <https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689>
- INPI - Intellectual Property Resources: <https://www.inpi.fr/en>
- Creative Commons - Licenses and Tools: <https://creativecommons.org/licenses/>
- ANSSI - Security Recommendations for Mobile Applications: <https://www.ssi.gouv.fr/en/guide/>
Supports
Slides, guided and practical work sheets.