Article 25(2) of GDPR says the following (emphasis mine):
The controller shall implement appropriate technical and organisational measures for ensuring that, by default, only personal data which are necessary for each specific purpose of the processing are processed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made accessible without the individual's intervention to an indefinite number of natural persons.
I understand everything up to the section highlighted in bold. Who is the "individual" in "individual's intervention"? The user of the controller's website?
If yes, does this basically say that an individual user, whose data is stored by a controller, has the right to "intervene" and ask for his/her data to be deleted?
If yes, why does it say an "indefinite number of natural persons"?
I thought that you can only ask for your own personal data to be erased, not somebody else's.