There is an interesting post on identity theft at Political Animal. The argument that Kevin Drum makes is that the cost of identity theft should be put on the business that lose the information by forcing them to notify those who have had their personal information stolen. This seems very sensible to me. The businesses can then weigh the cost of adequate security against the cost of losing information. It seems like a very simple solution. Much less complicated than having the government create security standards for the information.
In the comments on the post there was rather vacuous comment by someone named Al about how free market solutions would be best, but it did not really address what the free market solution was. That comment set off a fire storm of replies, and most did point out that people getting hurt by identity theft are not the customers of the information brokers that are responsible for losing the information, so the free market cannot punish those who are doing a bad job.