Re: So essentially..
Yes, you 'probably' don't get prosecuted and jailed. As long as you haven't made the slightest slip up that a malicious prosecutor can seize on and blow up out of all proportion.
And this is for professional security researchers. What happens if someone else notices by chance that due to someone's oversight, some data can be trivially de-anonymised? Do you know exactly what procedure to follow and who to notify, having never thought about this before? Can you find that out with certainty, within 72 hours of first going "Oh, that's odd"? Or would you do better to keep quiet and let the information leak out, rather than risk jail for trying to warn people?