A company uses anonymized data, but a practical linkage with another dataset can identify individuals. What should be reassessed?

1. Re-identification exposure and the adequacy of the data protection method
2. The dataset's file extension alone
3. Only whether direct names were removed
4. Automatic public release because one identifier is absent