I agree that if Netflix knew the data could be de-anonymized then they are liable. Just like if I bank knows that an identity thief is the emptying a customers bank account and does not stop it, they are liable.