The data doesn't need to be used now, today, for this purpose. What happens when an insurance company foists a new privacy policy on you, the insured, saying th

The data doesn't need to be used now, today, for this purpose. What happens when an insurance company foists a new privacy policy on you, the insured, saying that it'll be using back data that it's collected for new purposes? To my knowledge, there are no laws on the books in the US that prevent that kind of behavior (ex-post-facto only applies to the legal system), and I'd imagine few would change insurance providers because of a privacy policy change.