EU could make firms disclose network security breaches