EU officials say that the new regulation is needed to remove the stigma associated with data breaches, as well as improve information sharing between critical infrastructure service providers – the frequent target of cyber attacks.

"We want to change the culture around cybersecurity from one where people are sometimes afraid or ashamed to admit a problem, to one where authorities and network owners are better able to work together to maximize security," an unnamed EU official told Reuters, which first reported the news of the EU's draft proposal.

The draft report suggests that critical infrastructure is too valuable to be left to voluntary reporting requirements, InformationWeek reports. The EU report also suggests that businesses in Europe currently “lack effective incentives to provide reliable data on the existence or impact” of data breaches or information security incidents.

“Minimum security requirements should also apply to public administrations and operators of critical information infrastructure to promote a culture of risk management and ensure that the most serious incidents are reported,” the draft report says.

Not unlike in the U.S., current data-breach notification requirements in Europe are governed by a patchwork of country-level provisions. The different laws have different thresholds for triggering notifications, and differ also as to whether individuals, regulators or both should be notified, the article reports.

A draft data protection regulation currently being debated by the EU would create a single data breach notification requirement for all of Europe, but EU watchers say that the debate could take at least another year or two to be resolved, InformationWeek reports.