The records have now been winnowed down to 90 million. The problem won’t necessarily disappear, privacy experts said.