Luca Tosoni

Luca is an experienced European lawyer, focusing on privacy, data protection, cybersecurity, artificial intelligence, life sciences and technology regulation more generally. He advises clients in a wide range of industries building on his unique 360-degree experience, having worked on these matters as a business lawyer, regulator and academic. 

Prior to working at Schjødt, Luca served as a Specialist Legal Director (juridisk fagdirektør) in the international affairs department of the Norwegian Data Protection Authority (Datatilsynet) where his role included representing Datatilsynet at meetings of the European Data Protection Board (EDPB). In that capacity, he led or contributed to the drafting of several EDPB binding decisions, opinions and guidelines, such as the guidelines on legitimate interest. As part of his work at European level, Luca co-chaired the EDPB’s Key Provisions (KEYP) expert sub-group, which is the group responsible for preparing EDPB documents on core requirements and principles of the General Data Protection Regulation (GDPR). In addition, Luca was responsible for managing a number of cross-border enforcement actions led by Datatilsynet. 

Before joining Datatilsynet, Luca gained significant experience in private practice, working at a top-tier international law firm in Brussels, where he advised clients on a wide range of EU and national law matters, in particular in the life sciences and technology industries. He also assisted and represented clients in several cases before European courts, including in a landmark case on the ‘right to be forgotten’ (Biancardi v. Italy). 

Luca holds a PhD in cybersecurity law from the University of Oslo and is a sought-after lecturer and speaker. He has published extensively on technology regulation and data protection, and his academic work has been cited with approval by the Court of Justice of the European Union and by several data protection authorities. He has also been appointed to a number advisory and expert boards, such as the Advisory Group of the European Union Agency for Cybersecurity (ENISA).