When data protection by design and data subject rights clash