Abstract

In order to implement the European General Data Protection Regulation, a range of measures are required to set up an organisational model of data management based on the principles of accountability, privacy by design and by default. From the point of view of the administration, the establishment of this management model within the regulatory framework of the administrative organisation and action raises a number of critical issues along the entire chain of intervention on data. The aim of this paper is to demonstrate to what extent the legal complexity approach can be useful in containing such criticalities. To this end, the paper is divided into three parts. In the first part of the paper, a selection of problematic case studies in the field of personal data protection are analysed in order to highlight the complexity of the legal phenomenon underlying them. In the second part, on the basis of the identification of a methodology based on the consideration of legal complexity, an attempt is made to ascertain to what extent the problems analysed in the first part can be tackled by means of an approach based on simplification, understood not only as the elimination of complication, but above all as the management of complexity. In the final part, we will try to estimate the effects of using this methodology with regard to the management of the critical issues raised by data protection legislation within the administrative system.