That's quite a failure of creativity. Like Google with their "I'm not touching you" profiling by metadata, you don't have to identify an individual to be able to target them.

There's also an incredible asymmetry of information in these fields and industries. What makes you think you know enough to say that protected data isn't being laundered, legally or illegally, through private companies around the globe to inform the very opaque pricing of medical services and insurance in the US?