Europe’s data-protection regulatory framework needs updating, but it will be two to three years before companies even see proposals, Europe’s top data protection official said Monday.