‘Is the principle of data privacy enough for insurance?’