the individual unidentifiable, whenever this can be done. The information, thus
redacted, must be disclosed unless another exemption applies”
about which we agree provided what is left has value.
53. In Information Commissioner v Magherafelt District Council [2012] UKUT 263 (ACC)
the UT referred to the “motivated intruder” test which is a person:“….who starts without any prior knowledge but who wishes to identify the
individual or individuals referred to in the purportedly anonymised information
and will take all reasonable steps to do so.’. The question was then one of
assessment by a public authority as to ‘… whether, taking account of the nature of
the information, there would be likely to be a motivated intruder within the public
at large who would be able to identify the individuals to whom the disclosed
information relates.”
54. The data protection principles are those set out in section 34(1) DPA. They
include Article 5(1) GDPR which provides that personal data shall be processed
“lawfully, fairly and in a transparent manner as regards the data subject”
55. Article 6(1) provides that the processing of personal data shall only be lawful if
at least one of the following applies:(a) the data subject has given consent to the processing of his or her personal data
for one or more specific purposes;
(b) processing is necessary for the performance of a contract to which the data
subject is party or in order to take steps at the request of the data subject prior to
entering into a contract;
(c) processing is necessary for compliance with a legal obligation to which the
controller is subject;
(d) processing is necessary in order to protect the vital interests of the data subject
or of another natural person;
(e) processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in the controller;
(f) processing is necessary for the purposes of the legitimate interests pursued by
the controller or by a third party, except where such interests are overridden by the
interests or fundamental rights and freedoms of the data subject which require
protection of personal data, in particular where the data subject is a child.
16