Privacy by design and privacy by default