The EU’s executive body is preparing new legislation that lawyers say is likely to have as big an impact as GDPR.