1) if they have competitors, they can't do much "passing along to consumers" to begin with, and 2) I thought insurance companies were supposed to be really good

1) if they have competitors, they can't do much "passing along to consumers" to begin with, and 2) I thought insurance companies were supposed to be really good at assessing risk, and markets are magically efficient and all that, so shouldn't the better insurers unravel such schemes? Plus it's not like losing, you know, brand recognition and such is nothing. Point is it should hurt a lot to leak personal data, and it's this or directly regulate (this sort of thing used to be the right-wing way of doing things, but now doing anything at all about these problems, no matter the mechanism, is "left", at least in the US—see also health care)