The aim of the training is to enable students to understand the basics of data protection and make them more conscious data subjects by raising their awareness regarding the data protection challenges affecting them at the university and later on during their professional lives. They will get familiar with the basic legal concepts, complemented by the necessary IT knowledge to better understand data protection in the 21st century. Lecturers, trainers and jury members are well-established academic lecturers from different universities or members of the Hungarian data protection authority.

Who is it for?
PhD students from all academic disciplines who are interested in expanding their knowledge regarding data protection.

Content

• Module 1 – Theoretical Courses: 13-15 November 2028


• Module 2 – Group Work and Presentation: 28-30 November 2028

After participating in the theoretical courses (Module 1) students will be assigned to groups where they have to solve real-life scenarios (Module 2) based on the first module, as well as on the materials previously assigned by the lecturers.

Assessment:

Module 1: pass an online test based on the topics discussed during the theoretical lectures. Passing the test is a requirement to participate in Module 2.

In Module 2 students will present their solutions in a peer-review system and discuss the findings under the direction of the trainers and jury members. On the last day, the jury announces the results among the participants: who performed best in the field of data protection!

Completion Reward:

Students completing the training will receive 4 ECTS credits, as well as a Certificate of Attendance and a Transcript of Records

Recommended Readings:

1. Core Legal Sources

1.Regulation (EU) 2016/679 (GDPR). (Primary legal source) [eur-lex.europa.eu], [edps.europa.eu]

2. Charter of Fundamental Rights of the European Union (Articles 7–8).


3. Convention 108+ (Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data).

2. Foundational Works


3. Lynskey, O. (2015). The Foundations of EU Data Protection Law. DOI: 10.1093/acprof:oso/9780198718239.001.0001


4. Bygrave, L. A. (2022). Data Privacy Law: An International Perspective (2nd ed.). DOI: 10.1093/oso/9780198863168.001.0001


5. B.Coppens and O. Zendra. Is privacy possible in a digital world? In HiPEAC Vision 2023. (DOI: 10.5281/zenodo.7461921)


6. Elliot, M., Mandalari, A. M., Mourby, M., & O’Hara, K. (2024).

Dictionary of Privacy, Data Protection and Information Security.

Cheltenham, UK: Edward Elgar Publishing Limited. (DOI:

10.4337/9781035300921)

5. González Fuster, G. (2014). The Emergence of Personal Data Protection as a Fundamental Right of the EU. DOI: 10.1007/978-3-319-05023-2


6. Solove, D. J. (2021). Understanding Privacy. Harvard University Press.


7. Nissenbaum, H. (2010). Privacy in Context. Stanford University Press.

3. GDPR literature


4. Kuner, C., Bygrave, L. A., & Docksey, C. (Eds.). (2020). The EU General Data Protection Regulation (GDPR): A Commentary. DOI: 10.1093/oso/9780198826491.001.0001


5. Voigt, P., & von dem Bussche, A. (2023). The EU General Data Protection Regulation (GDPR): A Practical Guide (2nd ed.). DOI: 10.1007/978-3-031-33747-6


6. Hijmans, H. (2022). The European Union as Guardian of Internet Privacy. DOI: 10.1007/978-3-030-94961-8


7. Malgieri, G. (2022). Vulnerability and Data Protection Law. DOI: 10.1093/oso/9780192893857.001.0001

4. Recent Governance and AI Materials


5. European Data Protection Board. Opinion 28/2024 on Certain Data Protection Aspects Related to AI Models. [edpb.europa.eu], [edpb.europa.eu]


6. European Parliament. (2025). Interplay Between the AI Act and the EU Digital Legislative Framework. [europarl.europa.eu]


7. Feretzakis, G., Vagena, E., Kalodanis, K., Peristera, P., Kalles, D., & Anastasiou, A. (2025). GDPR and Large Language Models: Technical and Legal Obstacles. Future Internet, 17(4), 151. DOI: 10.3390/fi17040151 [mdpi.com]

1. RECOMMENDED READINGS (10)


2. Cohen, J. E. (2019). Between Truth and Power. DOI: 10.1093/oso/9780190246693.001.0001


3. Floridi, L. (2014). The Fourth Revolution. DOI: 10.1093/acprof:oso/9780199606726.001.0001


4. Kuner, C. (2013). Transborder Data Flows and Data Privacy Law. DOI: 10.1093/acprof:oso/9780199675678.001.0001


5. Novelli, C., Casolari, F., Hacker, P., Spedicato, G., & Floridi, L. (2024). Generative AI in EU Law: Liability, Privacy, Intellectual Property and Cybersecurity. arXiv:2401.07348. [arxiv.org]


6. Li, W., Zhang, Y., Zheng, Q., & Li, A. (2026). How the Legal Basis for AI Training is Framed in Data Protection Guidelines and Interventions. International Data Privacy Law. DOI: 10.1093/idpl/ipaf032 [academic.oup.com]


7. Bender, E. M., Gebru, T., McMillan-Major, A., & Shmitchell, S. (2021). On the Dangers of Stochastic Parrots. DOI: 10.1145/3442188.3445922


8. Floridi, L., & Chiriatti, M. (2020). GPT-3: Its Nature, Scope, Limits, and Consequences. DOI: 10.1007/s11023-020-09548-1


9. Wachter, S., Mittelstadt, B., & Floridi, L. (2017). Why a Right to Explanation of Automated Decision-Making Does Not Exist in the GDPR. DOI: 10.2139/ssrn.2903469


10. Selbst, A. D., & Powles, J. (2017). Meaningful Information and the Right to Explanation. DOI: 10.1093/idpl/ipx022


11. Kaminski, M. E. (2019). The Right to Explanation, Explained. DOI: 10.2139/ssrn.3196985

Mandatory Case Law

Court of Justice of the European Union (CJEU)

Google Spain (C-131/12)

Digital Rights Ireland (C-293/12 & C-594/12)

Schrems I (C-362/14)

Tele2 Sverige (C-203/15)

Nowak (C-434/16)

Fashion ID (C-40/17)

Planet49 (C-673/17)

GC and Others v CNIL (C-136/17)

Schrems I & II (C-311/18) [eur-lex.europa.eu], [europarl.europa.eu]

Österreichische Post (C-300/21)

SCHUFA (C-634/21)

Meta Platforms (C-252/21)

Maximilian Schrems v Meta Platforms Ireland Limited (C-446/21) [eur-lex.europa.eu]

Österreichische Post (C-300/21, 2023)

Natsionalna agentsia za prihodite (C-340/21, 2023)

Meta Platforms Ireland (C-252/21, 2023)

SCHUFA Holding (C-634/21, 2023)

Norra Stockholm Bygg (C-268/21, 2023)

Maximilian Schrems v Meta Platforms Ireland Limited (C-446/21, 2024)

IAB Europe (C-604/22, 2024)

Lindenapotheke (C-21/23, 2024)

Deutsche Wohnen (C-807/21, 2024)

Ministerstvo zdravotnictví (C-659/22, 2024/2025)

European Court of Human Rights (ECtHR)

S. and Marper v United Kingdom

Rotaru v Romania

Uzun v Germany

Barbulescu v Romania

Satakunnan Markkinapörssi Oy v Finland

López Ribalda v Spain

Big Brother Watch v United Kingdom

Big Brother Watch and Others v United Kingdom (Grand Chamber, 2021)

Breyer v Germany (2020)

Glukhin v Russia (2023)

Podchasov v Russia (2024)

Scheduled...