## 1 Big Data in the General Data Protection Regulation (GDPR): From Risk to Resource  
Big Data is in the spotlight as the new General Data Protection Regulation (GDPR) [1] entered into force. The fast rise of the data in so many different contexts has been bringing about significant changes in science and society, paving the way to issues and opportunities which still need to be clearly identified [2]. However, the discussion on risks, benefits and application fields of Big Data is often biased by an ambiguous use of the expression, which fosters an overlap between aspects related to the collection, storing and processing of data [3]. Social research reflections on the topic, for example, are mostly focused on the benefits of data analysis, questioning the knowledge arising from the application of data-mining methods. From the legal perspective, instead, more attention is paid to the risks related to data gathering, with questions \"about how we protect our privacy and other values in a world where data collection is increasingly ubiquitous\" [4]. This misalignment makes a cross-fertilization between law and data-driven social sciences difficult, causing disorientation and limiting the opportunities to benefit from data, especially in the management of global social challenges [5]. Against this backdrop, the new GDPR seems to foster a reversal of course. While securing personal data from privacy violations, the regulation, in fact, challenges policymakers to exploit data-driven social research to provide knowledge-based policies. Actually, the opportunity to draw benefits from Big Data has been already taken into account by several international agendas, which suggest governments to rely on data analysis in order to improve economic growth and public well-being [6; 7]. With the GDPR entering into effect, however,the opportunity to exploit knowledge arising from Big Data turns into a rule for member states, with an explicit push to consider data as a resource for the design of public policies. A feature as interesting as it is little considered so far in regulation analyses, which are often focused on the protection of personal data. Without a doubt, data protection remains the main goal of GDPR, which innovates the previous regulatory framework with a set of rigorous constraints aimed at protecting citizens from any kind of abusive storage and processing of personal data, including automated decision-making and profiling practices. In this vein, it can be read the Recital 71 which says: \"The data subject should have the right not to be subject to a decision, which may include a measure, evaluating personal aspects relating to him or her which is based solely on automated processing and which produces legal effects concerning him or her or similarly significantly affects him or her\". The regulation aims at defining, to some extent, an ontology of the legal risks related to Big Data, which include not only privacy violations deriving from unauthorized collection of data, but also threats to civil liberties caused by arbitrary and discriminatory uses of data analysis tools--e.g., cases of data \"secondary use\" [8] or control creep [9]. On the other hand, the GDPR seems to enhance the opportunities arising from data-driven social sciences, calling for an interaction between open data, social research and policy decisions. Recital 157, in fact, underlines how massive data--specifically health-related data--can represent an ally in social research, providing information about long-term correlations in social conditions, such as unemployment and education with other life conditions. As it claims, \"Research results obtained through registries provide solid, high-quality knowledge which can provide the basis for the formulation and implementation of knowledge-based policy, improve the quality of life for a number of people and improve the efficiency of social services\" [1].