As has been mentioned elsewhere in the thread -- de-dupe isn't responsible.
If Dropbox is storing your files -- then the TLA can always request Dropbox to give a list of users that have the same file. (Unless you have some form of independant crypto/hashing)