To be more specific she de-anonymised 7 individuals in the data set and claimed she could do more (if you used someone's semi-personal information).

The risk with good de-identification is generally not that they can find everyone but that given enough knowledge they can find one individual. Or in other words, that your friend find you in the data set with enough effort. It's also why you're supposed to remove famous people from such data sets.