Which of the following most embodies the principle of Data Protection by Default?

Data Protection by Default is about ensuring that, by default, only necessary personal data is processed for each specific purpose and that the highest privacy settings are applied automatically. The scenario where a website uses an opt-in form for marketing emails reflects this principle because it ensures that users must actively consent to their data being used for marketing purposes, rather than having it enabled by default.