According to one privacy expert, Uber still needs to prove that it’s removed all personally identifying info from the data