Companies doing business in Europe would have new data privacy rules and fines for violations, under proposals made public Wednesday. The proposals from the European Commission follow a two-year study of how sites such as Facebook, Google and Yahoo are being used.

Proposed fines are very stiff, up to 2 percent of a company's annual revenue. For Google, as an example, that could amount to as much as three-quarters of a billion dollars. The proposed rules will become law by the end of next year if approved by all members of the European Union and the European Parliament.

'Right to Be Forgotten'

Google, which has been under investigation by various countries for privacy violations, said through a spokesperson in Brussels that it supports "simplifying privacy rules in Europe to both protect consumers online and stimulate economic growth." The company said it that it was possible "to have simple rules that do both."

The European commissioner for data privacy, Viviane Reding, said the new legislation was needed to better protect consumer privacy. She told reporters that, while personal data protection is a fundamental right, "citizens do not always feel in control" of their information. Reding said the proposal would save businesses nearly $3 billion annually.

The previous European laws on privacy date from 1995, when less than 1 percent of European users had access to the Internet.

One component of the proposed legislation is what Reding describes as "the right to be forgotten," where a user can require that all data about them is removed from a Web site and related databases.

In addition, the guidelines would require user consent to maintain customer data, rather than simply a default consent. Social networking sites often remove user information from public view if requested, but keep the information as part of its database.

27 Rules to One

The commission...