The UK's National Health Service medical records are sold by the millions to data companies — in supposedly "anonymized" form, but they can be de-anonymized.