UIMOIBK030 Information legislation

Faculty of Philosophy and Science in Opava
Winter 2026
Extent and Intensity
0/0/0. 4 credit(s). Type of Completion: zk (examination).
Teacher(s)
Mgr. Kamil Matula, Ph.D. (lecturer)
Guaranteed by
Mgr. Kamil Matula, Ph.D.
Institute of Computer Science – Faculty of Philosophy and Science in Opava
Course Enrolment Limitations
The course is also offered to the students of the fields other than those the course is directly associated with.
fields of study / plans the course is directly associated with
Course objectives

The course introduces informatics students to the legal rules they will encounter when developing, operating and managing information systems. Instead of reading statutes, it explains law through concrete situations from IT practice: who owns code written in employment, whether a library from GitHub may be used, what to do after a data breach, or which rules apply to an AI system.


Topics include copyright in software and databases, IT contracts, open-source licences, law and artificial intelligence including the AI Act, personal data protection (GDPR), cybersecurity (NIS2, Czech Act No. 264/2025 Coll.) and cybercrime, liability for digital products (Cyber Resilience Act), regulation of the digital market (DSA, DMA, Data Act) and e-government.


The aim is not to train lawyers. Graduates should be able to recognise a legal risk in practice, find the applicable legislation, propose technical or organisational measures and know when to involve a lawyer.

Learning outcomes

Upon completion of the course, the student will be able to:


Knowledge

  • explain how copyright protects computer programs and databases, and distinguish between employee works, commissioned works and licences;
  • describe the main families of open-source licences (permissive and copyleft) and their obligations;
  • identify the key Czech and EU legislation relevant to IT (Copyright Act, GDPR, Cybersecurity Act, AI Act, CRA, DSA, Data Act) and who it applies to;
  • explain the basic concepts of personal data protection (controller, processor, legal basis, personal data breach).

Skills

  • recognise a legal issue in a specific IT situation and determine which legislation applies;
  • find the current version of legislation in e-Sbírka and EUR-Lex and navigate it;
  • check the licences of a software project’s dependencies and create or evaluate an SBOM;
  • classify an AI system by risk category under the AI Act;
  • propose a response to a security incident and a personal data breach, including notification deadlines.

Competences

  • carry out a legal compliance audit of their own or a selected IT project and propose corrective measures;
  • explain legal risk clearly to a non-technical audience and recognise when legal advice is needed.
Syllabus
    1. Introduction: law in IT practice. Sources of law, Czech and EU law, finding legislation (e-Sbírka, EUR-Lex), legal risks across the software life cycle.
    2. Copyright in software and databases, IT contracts. Programs as copyright works, the sui generis database right, employee and commissioned works, contracts for work and licence agreements, SaaS.
    3. Open source and licences. GPL, LGPL, MIT, Apache, Creative Commons; licence compatibility, licence compliance, SBOM (SPDX, CycloneDX).
    4. Artificial intelligence and intellectual property. Authorship of generative AI outputs, training data and text and data mining, terms of use of AI tools.
    5. Industrial property and trade secrets. Trademarks and domain names, patentability of software, trade secrets and NDAs.
    6. Personal data protection I. GDPR: controller and processor, legal bases, data subject rights, privacy by design.
    7. Personal data protection II. Personal data breaches and notification, cookies and electronic communications, transfers outside the EU.
    8. Cybersecurity and cybercrime. NIS2 and Czech Act No. 264/2025 Coll., obligations of regulated entities, incident reporting; computer crime, ethical hacking.
    9. Security of and liability for digital products. Cyber Resilience Act, vulnerability handling, liability for defective software.
    10. The AI Act. Risk categories, prohibited practices, high-risk systems, transparency obligations, AI literacy, application timeline.
    11. Digital market and consumers. DSA and DMA, Data Act, digital content and services for consumers, dark patterns, accessibility.
    12. E-government and the public sector. Freedom of information and open data, the right to digital services, electronic identity and eIDAS 2, trust services.
Literature
    required literature
  • NULÍČEK, Michal. GDPR – obecné nařízení o ochraně osobních údajů. 2. vydání. Praha: Wolters Kluwer, 2018, 559 pp. ISBN 978-80-7598-068-7. info
  • Česko. Úplné znění Ústavního zákona České republiky národní rady č. 1/1993 Sb., Ústava České republiky. Úplné znění Usnesení České národní rady č. 2/1993 Sb., o vyhlášení Listiny základních práv a svobod jako součásti ústavního pořádku České republiky.
  • ŠTĚDROŇ, Bohumír. Ochrana a licencování počítačového programu. Právní monografie. Praha: Wolters Kluwer, 2010, 199 pp. ISBN 978-80-7357-555-7. info
  • SRSTKA, Jiří, Jan BARTÁK, Tomáš DOBŘICHOVSKÝ, et al. and SRSTKA, Jiří, Jan BARTÁK, Tomáš DOBŘICHOVSKÝ, et al. Autorské právo a práva související: vysokoškolská učebnice. Vydání první. Praha: Leges, 2017. ISBN 978-80-7502-240-0. info
    recommended literature
  • Česko. Ochrana osobních údajů: zákon o ochraně osobních údajů a další právní předpisy. GDPR: obecné nařízení Evropského parlamentu a rady (EU) 2016/679, o ochraně osobních údajů. Ostrava: Sagit, [2017], 111 s. ISBN 978-80-7488-241-8
  • Česko. Autorské právo, průmyslová práva: velká novela autorského zákona od 20. 4. 2017. Ostrava: Sagit, 2017, 224 s. ISBN 978-80-7488-225-8
  • CHALOUPKOVÁ, Helena. Autorský zákon: komentář. 5. vydání. V Praze: C.H. Beck, 2017, 364 s. Beckovy komentáře. ISBN 978-80-7400-671-5.
  • KARABEC, David. Průmyslová práva a licence. Praha: Vysoká škola finanční a správní: Educopress, 2017, 68 pp. ISBN 978-80-7408-155-2. info
Teaching methods
Interactive lectures with ongoing questions and short check tasks.
Case studies: group work with case cards based on IT practice (two cards per topic), discussion and joint debriefing.
Practical exercises: searching e-Sbírka and EUR-Lex, checking dependency licences and working with an SBOM, classifying an AI system under the AI Act, simulating incident reporting.
Project-based learning: a semester project in the form of a legal compliance audit of an IT project, with consultations during the semester.
Self-study of the study materials, legislation and recommended literature.
Assessment methods
  1. Semester project (prerequisite for the examination). The student submits, by the deadline, a legal compliance audit of a selected IT project: a map of applicable legislation, identification of legal risks, proposed measures and sources used. The project must meet the set requirements.
  2. Oral examination in the form of a defence. The student summarises the main findings of the audit and discusses the project with the examiner. Questions cover the project and related topics of the course outline, typically as a model situation: what would change if the project processed different data, used AI or were distributed to customers.

Assessment criteria: correct identification of applicable legislation and risks, quality and feasibility of the proposed measures, use of sources and the ability to apply legal rules to a new situation during the discussion. Understanding is assessed, not the reproduction of statutory text.


The course ends with an examination graded on the A–F scale.

Language of instruction
Czech
The course is also listed under the following terms Winter 2020, Winter 2021, Winter 2022, Winter 2023, Winter 2024, Winter 2025.
  • Enrolment Statistics (recent)
  • Permalink: https://is.slu.cz/course/fpf/winter2026/UIMOIBK030