Companies would be required to immediately disclose breaches, and individuals would get the "right to be forgotten" under a European Union proposal.