Companies face fines as high as 2 percent of yearly global salesfor losing personal data under an overhaul of European Unionprivacy rules.

Data protection agencies in the EU's 27 countries would gain thepower to sanction companies that violate requirements for handlingpersonal information proposed by the European Commission today. Themeasures, which also target online- advertising and socialnetworking sites, update the EU's 17-year-old data protectionpolicies.

The EU overhaul would also clamp down on data lapses such asSony Corp.'s six-day delay in warning customers about a cyberattack that exposed more than 100 million customer accounts, thesecond-largest online data breach in U.S. history. Industry groupswith members including Microsoft Corp. and Google Inc. have warnedagainst overly strict data-privacy rules that may stifleinnovation.