The European Commission on Wednesday proposed an overhaul to its data protection laws, which will provide users with more control over their data and make the process of monitoring data security less complex for agencies across the EU.
The rules, first proposed in November, would update laws passed in 1995 before the Internet became a part of our daily lives.
"My proposals will help build trust in online services because people will be better informed about their rights and have more control of their information," EU Justice Commissioner Viviane Reding said in a statement. "The reform will accomplish this while making life easier and less costly for businesses."
Specifically, consumers would be allowed easier access to the personal data and have the "right to data portability" should they want to transfer information from one service to another.
The proposal also includes a "right to be forgotten," which would require businesses to delete a customer's personal data if they request it.
According to the commission, personal data "can be anything from a name, a photo, an email address, bank details, your posts on social networking Web sites, your medical information, or your computer's IP address."
Failure to abide by these rules could result in fines up to $1.3 million, or 2 percent of annual turnover.
On the other side, today's proposal also aims to make it easier to monitor security. Since 1995, the 27 EU member states have implemented the rules differently, creating varying levels of enforcement.
"A single law will do away with the current fragmentation and costly administrative burdens, leading to savings for businesses of around 2.3 billion a year," the commission said today.
Companies will only have to deal with a single, national data protection authority in the country where they have their headquarters. At this point, companies must notify all 27 data protection authorities, but the proposal "provides for increased responsibility and accountability for those processing personal data," the commission said.
Serious data breaches must be reported within 24 hours, if feasible, the EU said.
Companies based outside the EU that handle the personal data of its citizens like Facebook or Google must follow the regulations.
The commission said its proposals will now be passed on to the European Parliament and EU Member States for discussion. They would take effect two years after they have been adopted.
For more from Chloe, follow her on Twitter @ChloeAlbanesius.