> But in these cases these are not direct unintended consequences of the legislation but rather consequences of companies failing to do their due diligence when implementing GDPR.
The complexity of additional law is part of its unintended consequences.
How is sending the recordings of one user to another a result of law complexity?
In any case, there's no increased complexity here; the Data Protection Directive (enacted in 1995) already mandated access to one's data (Article 12 - Right of access). The GDPR mostly gave some real teeth to that existing right.
The complexity of additional law is part of its unintended consequences.