By design or by default?

GDPR requires data protection by design and by default practices. One cannot find a definitive and exhaustive list of such practices and are constantly, but there are many ways to achieve them by applying the core principles behind their meaning.

Imagine that you lead an urban mobility company that collects the geo-location data of your customers to build AI models to predict their route choice and behavior.