Having trouble understanding private files in Drupal 7
Whenever possible it's recommended that you choose a directory located
  outside of your Drupal root folder (or actually outside your web
  root), which may be tricky if you are on a shared host. If you do have
  access though, you can choose a private directory which will be on the
  same level as your web root directory (often called public_html or www
  or similar).


From Working with files in Drupal 7 and Drupal 8.

The best practice is to place your private files outside of your webroot, so they should not be inside /var/www as that would make them accessible over the web. Place them in /var/somefolder instead, make sure your webserver has read write access to that folder. After that you should only be able to access them via /system/files/test.example.doc and it should not work for anonymous users.

UPDATE:

Above is based on the assumption you were accessing the file via example.com/drupal-private-file-system/test.example.doc. this can be prevented by using the linked best practise guide.

If an anonymous user can access your files with on url like example.com/system/files/test.example.doc you have a problem with your permissions and anonymous users are given the permission to download private files.