Data Protection by Design and by Default

1 In European Union (EU) law, the principal legislative elaboration of the concept ‘Data Protection by Design and by Default’ (‘DPbDD’) occurs in three provisions: Article 25 General Data Protection Regulation (Regulation (EU) 2016/679; ‘GDPR’); Article 20 Data Protection Law Enforcement Directive (Directive (EU) 2016/680; ‘LED’); and Article 27 Regulation on Data Protection for EU Institutions and Bodies (Regulation (EU) 2018/1725; ‘EUDPR’). Each of these provisions bears the title ‘[d]ata protection by design and by default’. As elaborated in paragraph 7 of this...