What is Data Protection by Design and by Default?