I think the responsibility does rest with Netflix, because it's almost outside the control of one person to keep identities separate these days. Every bit of in

I think the responsibility does rest with Netflix, because it's almost outside the control of one person to keep identities separate these days. Every bit of information released vastly increases the chance of identification. To given an example - let's say Google as part of a new anti-fraud service released an MD5 hash of every e-mail address with a Google account, plus a MD5 hash of every IP that account had been successfully logged in from. Sounds fairly anonymous - except that every website owner would now be able to match up every duplicate-but-separate account in their database to find out who had two or more identities, even if the user had been careful to use two separate machines for that specific site.