wouldnt "Any person found to have implemented a system which violates the rights of people in xyz way will be punished with imrisonment" work ?
Again, this is not discrimination if it’s done for specific individuals, even if it’s done using data collected in aggregate. Banning a protected group wouldn’t be illegal. But banning a specific person would not.
Whether it’s legal to sell that same data as a list of undesirables is the open untested question.