Via http://www.stat.columbia.edu/~cook/movabletype/archives/2009/12/privacy_vs_know.html:

I'm not sure whether the litigators have read this particular section of the Netflix prize rules:

To prevent certain inferences being drawn about the Netflix customer base, some of the rating data for some customers in the training and qualifying sets have been deliberately perturbed in one or more of the following ways: deleting ratings; inserting alternative ratings and dates; and modifying rating dates.

So yes, you can match a set of reviews with someone else, but how will you know that it's really a person and not a random coincidence? 0.5 million review traces give plenty of opportunity for a false positive match. Netflix learned from AOL's data release disaster, which resulted in a few people getting fired.

The movies they attach are not very good.

I have some Python source code for doing similar things with the case of European nations on http://www.stat.columbia.edu/~cook/movabletype/archives/2007/06/animated_mds_co.html (there is an animated GIF there).

A bit more discussion about my methodology is at http://www.stat.columbia.edu/~cook/movabletype/archives/2007/06/nations_of_euro.html