Proposed EU cyber security law would firm up breach notification rules