I responded to most of the points in a new top-level comment. As for whether there is a violation of privacy even if the conclusions are erroneous, no, I don't

I responded to most of the points in a new top-level comment. As for whether there is a violation of privacy even if the conclusions are erroneous, no, I don't think that it is. Some of my colleagues argue that it is, but I don't agree with that point of view. In other words, in order to convince you that there is a privacy problem I have to convince you of the math in the paper. Merely the fact that we came up with an algorithm that may or may not be correct is not sufficient. That FAQ question is a big red herring. Some of the objections to our paper during peer-review were along the lines of "if Netflix had esentially duplicated every record in the database, how could you be sure you found the right record? What does right record even mean?" No really, it was that silly. So it was meant to be a way to justify the fact that de-anonymization can happen even if you didn't find "the right record."