It hasn't been approved yet, but European Union has prepared some big changes to its data protection laws, it's first significant one since 1995, according to ft.com.  The Financial Times got a hold of leaked documents, and while it still has to be voted on, it found the following proposals, among others:

• Companies could get fined of up to 5% of global sales
• Fines of up to 10% of sales if there are antitrust violations
• Companies who sell data to third parties without authorization are held responsible (and not the third parties)
• Companies have 24 hours to notify data protection authorities and affected parties of a data breach
• Rules apply to foreign business subsidiaries in Europe
• The "right to be forgotten"
• Companies with more than 250 employees need a dedicated staff to deal with data protection issues

The draft legislation will be announced in January.  According to Zack Whittaker at zdnet.com, the legislation also includes measures to counteract the USA Patriot Act.  The new legislation will replace the current European Data Protection Directive (95/46/EC), which, among other things, is the framework on which European states have based their data protection laws (such as the UK's Data Protection Act of 1998).

Related Articles and Sites:
http://www.ft.com/cms/s/2/bf962998-1d01-11e1-a26a-00144feabdc0.html
http://www.zdnet.co.uk/blogs/security-bullet-in-10000166/firms-may-face-five-percent-fines-for-data-loss-10024955/
http://www.zdnet.com/blog/london/european-data-protection-law-proposals-revealed/1365