One of our key protections against privacy invasion, the stripping of personally identifiable information from databases, is not working, according to Paul Ohm of the University of Colorado School of Law.