 These were non-binding and in 1995, the European Union (EU) enacted a more binding form of governance, i.e.legislation, to protect personal data privacy in the form of the Data Protection Directive.According to the Data Protection Directive, companies operating in the European Union are not permitted to send personal data to "third countries" outside the European Economic Area, unless they guarantee adequate levels of protection, "the data subject himself agrees to the transfer" or "if Binding corporate rules or Standard Contractual Clauses have been authorised."