Personal data may penalise ‘uninsurables’