It's a grey area legally, and is usually prevented by ethics committees and industry bodies. Practically, if you collect the information you run the risk of a large anti-discrimination suit down the track. The usual proxy for race/religion is first name, last name and zip-code - name clustering gives very strong risk differentiation (I crunch numbers for insurance companies).

Depends if the jurisdiction you buy insurance in outlaws it.

This is a good overview:

http://nakedlaw.avvo.com/consumer-protection/why-is-it-legal...