Data protection by design e data protection by default: i concetti giuridici