Legislation requiring notice to consumers of security breacheshas topped the list of insurance-related bills enacted during the2005 legislative season, according to an insurance trade group.

As of the week ending Oct. 21, 19 states have enacted securitybreach laws and others may soon follow suit, according to theNational Association of Mutual Insurance Companies.

David Reddick, NAMIC state affairs manager, said that most newlaws use legislation enacted in California in 2002 as a model.

The California law defines "personal information" as a person'sname used in conjunction with his Social Security number, driver'slicense or California Identification Card number.

While California law applies to breaches by government agencies,as well as private individuals and businesses, some states havechosen to exclude state agencies, while others have limited the lawto state agencies only, Mr. Reddick said.

Red flags for the property-casualty industry includedefinitional expansion of "personal information" beyond theCalifornia model that will make it more difficult for multistateinsurers to comply, NAMIC said.

While most states don't set a specific deadline for complianceafter a security breach, Florida has put a 45-day time limit andrequires documentation be maintained for up to five years.

Nine states now require agencies or business to report breachesto consumer-reporting agencies, but the threshold that triggersthat further notice varies. "When new bill introductions areproposed, the threshold should be as high as possible to avoidfurther exposures for insurers," Mr. Reddick said.

Meanwhile, Congress is considering legislation that would setfederal rules for companies' consumer data security but would leavestate regulators in charge of enforcing adherence by insurancecompanies.