I really doubt all this stuff was “de-identified”
For example, 20 years ago, few people would have imagined that you could build a fingerprint of a person from all their behaviors on the internet. You didn't need to regulate away certain kinds of data collection to prevent such fingerprinting because it wasn't possible. With ML and AI, it has become possible.
My point is that as technology improves, "de-identification" takes on new meaning. Whatever de-identification was 20 years ago is not what de-identification is today. And whatever de-identification was used here is probably insufficient to guarantee that customers can't be identified.
We need new regulations and we need them yesterday.
De-identified but far from useless.
as an example, they can remove the names off these sales data, so you can't identify who purchased what items. However, the purchaser would be identified by some sort of number, and you would be able to extract information about purchasing habits, and aggregate these habits into usable information for advertising purposes (like targeting and profiling).
And that's before AI training for LLM purposes.