I think his point is just because the data in isolation isn't identification, we live in a world where multiple public datasets are easily used to make 99.9% correlation, yet laws still act like these associations are "technically challenging" Most of the problems are from actors who are very specifically motivated and we need to start a less isolated view of data breaches .