Application of data protection legislation