Just to re-emphasize, because I think it's really poorly understood: most "anonymized" data is a few additional data points away from being re-identified.
Data re-identification was already happening in 2006 (just one example below). And now there's exponentially more data available to use for this purpose.
>We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world’s largest online movie rental service. We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber’s record in the dataset. Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information.
Data re-identification was already happening in 2006 (just one example below). And now there's exponentially more data available to use for this purpose.
>We apply our de-anonymization methodology to the Netflix Prize dataset, which contains anonymous movie ratings of 500,000 subscribers of Netflix, the world’s largest online movie rental service. We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber’s record in the dataset. Using the Internet Movie Database as the source of background knowledge, we successfully identified the Netflix records of known users, uncovering their apparent political preferences and other potentially sensitive information.
[1] https://www.cs.utexas.edu/~shmat/shmat_oak08netflix.pdf