It's probably more efficient in legal terms to make it a blanket ban, so I agree with you on that front, but honestly, with this kind of data the risk is more about people selling snake oil than any real privacy concerns. Or I suppose something like this ending up on a credit report where the data is worse than useless because it's utterly meaningless! Noise in, noise out...