So your plan means governments will have to provide this insurance (there is precendent for governments providing insurance; eg Medicare in the US)
That means taxpayers will fund the payouts.
This is not a good solution. I don’t have an alternative, but I dont like this one.
That doesn't cause them to be unwilling to write a policy. What it does is cause the premiums to be high.
But the insurance companies will still want to mitigate the risk as much as possible, so they'll still dump compliance costs on the policy holders to try to mitigate the risk. And since the insurance is mandatory, they have no real incentive to minimize those costs or ensure that they achieve a worthwhile cost/benefit ratio. So mental health providers will have two new large operating costs imposed on them.
And the breaches will still happen, because most of the compliance requirements will be in the nature of having to install antivirus on your Linux servers and mandating passwords to be changed often enough that everybody writes them on a sticky note on the side of their monitor and the password reset mechanism becomes "easy to use" with the obvious implications of that.
This style of solution is common in healthcare in the US and is one of the reasons it's so expensive.
I'll note that the whole password on a sticky note example is not ideal, but doesn't weaken such systems against what is likely the biggest risk they face: network systems being compromised remotely.
This is of course not ideal, but a far cry better than not having such policies in place.
Until somebody posts a selfie with the sticky note in the background.
Insurance companies have the tools to deal with lack of information.
Most importantly car accidents have a known variance and are statistically predictable.
There are insurers that will take on one-off unpredictable risks (reinsurance), but equating cybersecurity to car insurance makes little sense.
Insurance companies can deal with skyscrapers or airline crash insurances, I don’t think privacy leaks should be harder to manage than actual death.
I know, I just thought car accidents were a bad way to make the point.
Data breaches vs skyscrapers/airplanes are harder to distinguish, so yeah those are more comparable.
Edit: that is, data breaches under the proposed system of high per-user liability are comparable.
I still have my doubts this kind of insurance is for sale with non-prohibitive prices.
Personally I think it's adequate just to fine companies for breaches and let them figure out if they want to insure or do better or both.
They'd just need to post a bond or similar, if they don't want to insure.
(Any insurance company would need to do something similar.)
Currently cybersecurity insurance pays the company, so actually the company itself has less incentive to fix real security issues (albeit with more incentive to resolve the specific security-audit needs of the policy.). And expensive policies reduce the pot of money available to fix problems.
Government policies that make directors criminally liable, and ways to spread that liability for criminally negligent security faults, would probably have a better effect than monetary fines.
A lower amount of financial risk would be enough to provide incentives for companies to buy insurance and improve their security in whatever way makes sense.
Do less frequent, more meaningful releases. Grow and invest in security talent. Move slow and polish things.
Plus infosec is definitely not taking everyone in with a proven interest. Even with the popular certs, there's still barriers to entry for no good reason.