And that's in just two months.

Unfortunately, the theft of sensitive personal data has become routine in America. When that data ends up in the hands of identity thieves, who are increasingly sophisticated and often linked to organized crime, the results can be devastating. That underscores the need for comprehensive legislation to protect consumers from identity theft.

The only reason we know about any of these incidents is that a California law forces institutions that suffer data breaches to notify the individuals whose personal information has been stolen. It's an example of smart and effective legislation that allows those who find themselves at high risk of identity theft through no fault of their own to protect themselves.

Sen. Dianne Feinstein has introduced a bill that would extend the California law across the nation, and Congress ought to put it on the fast track.

The next Congress should act on proposed legislation by Rep. Ed Markey, D-Mass., and Sen. Bill Nelson, D-Fla., that would regulate the data broker industry, which includes ChoicePoint, LexisNexis, Acxiom and other firms. These companies have compiled billions of records detailing the most personal details of every adult in America. For identity thieves, they are the Fort Knox of data.

What's more, the unregulated data brokers are increasingly playing the role of credit bureaus, selling data to businesses and agencies who use it to determine eligibility for employment, housing, travel and even voting. The Markey and Nelson bills would extend many of the rules covering credit bureaus to data brokers.

But as the incidents at UC-Berkeley and San Jose Medical Group show, sensitive data is not just in the hands of data brokers. Banks, hospitals, schools, utilities, Internet sites, telecommunications firms and other businesses and institutions all store vast amounts of personal information. The government must require that that information be encrypted and that the use of Social Security numbers be eliminated whenever possible.

In the digital age, there's no putting the personal data genie back in the bottle. But a serious legislative and law enforcement effort must be mounted to combat identity thieves.