Nothing in that article (with which I of course was familiar) says anything about "not possible to publish medical data in an anonymized fashion that does not infringe privacy rights". What it talks about is that some data sets may be improperly anonymized, and Netflix data set is one of them. It is undoubtedly true that anonymization is harder than it appears to a naive observer. It does not mean it is impossible.

> important take away from the above paper is that you need to know about all the other public data in the universe in order to really ensure anonymity.

I do not see how it's takeway from that paper.

> You never know what dataset will be leaked/published tomorrow correlating columns D-F in the spreadsheet you gave EPA to someone's first and last name.

You also never know whether somebody doesn't just break into your system, downloads all secret data and publishes them. Yes, you have no guarantee against bad actors and mistakes. But if that's the border condition then no research should be performed at all - after all, once the data exists, there's no guarantee it won't somehow get leaked out.

> The situation where IRB says "no" to public disclosure should explicitly trigger exemption

IRB is a part of the institution, right? So you essentially delegating the decision about the exception to (part of) the institution. What the point of having the rule then if every organization can make their own exceptions on demand? And that makes trivially easy to hide the data in sloppy research - just sprinkle some private data on it, show it to IRB, they cry out "no, this can't be released, no way!" - and voila, you are safe from review.