Who Does Data Protection Legislation Apply To