Data Protection by Design and by Default