It applies to every person responsible for the processing of personal data. See Article 12(b) of the EU's Data Protection Directive. [0] Most parties would however be able to rely on one of the grounds for processing listed in Article 7, such as consent, or as is the case for news media the Article 9 exception for freedom of expression.
In the Google Spain case the CJEU held that Google needs its own ground/exception to publish personal data. (Rather than saying "NYT is allowed to process these personal data, and therefore so am I")
In the Google Spain case the CJEU held that Google needs its own ground/exception to publish personal data. (Rather than saying "NYT is allowed to process these personal data, and therefore so am I")
[0] http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:319...