Sounds like a terrible idea to me.

A good way to boost profits for insurance companies, and force everyone into CYA practices and bureaucracy - a lot like the way malpractice insurance makes doctors more conservative and raises prices.

What we need, is simply more liability for damage cause by security breaches. Companies could then decide for themselves how much to insure, and how much to invest in better technology.

I’d like to see damages reflect the actual harms caused.

If a company leaks my data and I am subjected to identity theft as a result, that company should bear the cost of remedying that.