Why not just liability for lost data? Companies could then choose to hold the risk themselves or field it out to insurers.
It would be nice to require insurance or a bond to hold personal data so a company can't just disappear when data is lost.
This is exactly what I mean when I say that, if you want to see real corruption, just take a look at regular small businesses around you.
If this is possible without insurance then it’s possible with, and every insurance company will mandate the structure to limit payouts. Mandating insurance simple entrenches the insurers. Why, for instance, would you want to require Apple purchase insurance against its users’ data?
Side note: beneficial ownership [1] and affiliate definitions [2] are useful for such cases.
[1] https://www.investopedia.com/terms/b/beneficialowner.asp
[2] http://rule144opinion.blogspot.com/2014/02/rule-144-are-you-...
You can't limit insurance payouts this way, because the entity has to carry the insurance. You only limit the exposure of the larger entity after the assets of the liable entity, including any insurance coverage, are exhausted. But the more the mandatory insurance level is, the less likely spinning off to protect the parent is to ever be valuable, and it never protects the insurer, so they won't mandate it.
Of course, that's all irrelevant unless there's a significant change in how the law treats data security.
Risks (all kinds, not just technical) can be accepted, ignored, transferred and mitigated so it is important to have this option.
Its still not a great option for anyone involved as it is hard to price and last I checked had pretty low ceiling on payouts.
What would the actuarial standards be for something like that?
The financial math has to clearly be on the side of it being more profitable to practice proactive security.