Financial Times reports that under the European Commission's update to the Data Protection Directive, companies found to have mishandled personal data could be fined up to five percent of their global turnover--which could mean billions in losses for some. The rules would apply to foreign companies' European subsidiaries as well. Companies that have experienced a breach would have 24 hours to notify authorities of the incident. The proposal--now reportedly being finalized--would also require companies with more than 250 employees to dedicate staff to data protection, the report states. 
Full Story