Understanding GDPR's Privacy by Default: Examples and Design Principles