piece of information which could be combined with existing knowledge or assumptions to deduce or identify individuals”. 127. We proceeded on the basis that it was agreed that the issues being pursued were legitimate (eg see UoE at A192) and when dealing with personal data there was no dispute that it was right that the names of junior members were redacted but that in the GoA the Appellant had said (A51):“In particular, those University officials who took decisions concerning the Events recounted in the Report should be identified by name and title, for reasons of accountability. More generally, in accordance with the IC’s guidance regarding Section 40 (pp. 26–27), I suggest that University officials who are in senior, decisionmaking and/or public-facing roles should be identified” 128. We reviewed the Report and the Table in the open and closed versions, the submissions and the evidence provided. In addition to our Decision as regards Special Category Data:(a) there is no dispute that the names of junior members of staff should be redacted. (b) as regards more senior staff we do not completely accept the Appellant's submission. If the redacted material involved such people then the protection of section 40 would still apply to them. Processing to be lawful must be in accordance with the data protection principles. It is possible that when looking to balance the legitimate interests of the Request against the data rights of the individual the role or position of the data subject might be a factor to consider. However the role would not necessarily mean disclosure would be appropriate. For example (but theoretically) if a senior member of the UoE leadership had given personal evidence for the Report the seniority of the role would not be a relevant factor. (c) we accept UoE’s evidence and submissions regarding the difficulty of but importance of preventing inadvertent identification. When considering the background issues, strength of feeling on all sides and the context of a university community it makes it highly likely that motivated intruders exist and that they would wish to discover the identity of the individuals protected by redaction. We noted Mr Morris’s evidence (H997) that:“It was clear that some members of the university were spending significant amounts of time trawling through social media to seek out additional facts relevant to the Review and those who were involved in it...This reinforced to me that it was not just a theoretical risk that people might be motivated and able to piece 36