BRUSSELS — The European Union late Tuesday took a major step toward approving sweeping new data-protection rules that would strengthen online privacy, streamline legislation between the 28 member states and boost police and security cooperation.

The rules would for the first time create a strong data-protection law for Europe’s 500 million citizens, replacing an outdated patchwork of national rules that only allowed for tiny fines in cases of violation.

Instead, the parliament’s chief negotiator Jan Philipp Albrecht said that “firms breaching EU data-protection rules could be fined as much as 4 percent of annual turnover – for global Internet companies in particular, this could amount to billions.”