I mean, it’s not like anonymous datasets haven’t been de-anonymized before[0]. Successfully anonymizing data sets is a hard and subtle process, and it’s way harder than just removing major identifiers like city and birth date. For example age is obviously super important for vaccine and disease studies, and providing an age narrows down someone’s birthdate significantly.

And no, this isn’t under a “loose” NDA. This would be covered by HIPAA, which tends to be un-subtle about violations.

0 - https://www.cs.princeton.edu/~arvindn/publications/de-anonym...