Companies face fines as high as 2 percent of yearly global sales for losing personal data under an overhaul of European Union privacy rules.

Data protection agencies in the EU's 27 countries would gain the power to sanction companies that violate requirements for handling personal information proposed by the European Commission today. The measures, which also target online- advertising and social networking sites, update the EU's 17-year-old data protection policies.

The EU overhaul would also clamp down on data lapses such as Sony Corp.'s six-day delay in warning customers about a cyber attack that exposed more than 100 million customer accounts, the second-largest online data breach in U.S. history. Industry groups with members including Microsoft Corp. and Google Inc. have warned against overly strict data-privacy rules that may stifle innovation.