LUXEMBOURG – Foreign firms operating in the EU, including those that dominate the Internet, will be subject to a new data protection law which is still being finalized, the EU Commission said Friday.