105. The DN concludes (para 61 A11) that having seen no evidence of consent or any other Article 9(2) ground the processing of any special category data would breach the data protection principles. 106. We found no specific argument against this from the Appellant save as might relate to Professors Phoenix and Freedman which we deal with below. 107. We have reviewed the Report in the Closed Bundle. We are satisfied that the Report does contain special category material. In places that material is not directly connected to the name of a person. However in our view there will be times where redaction of a name alone would not protect the identity of the data subject from the “motivated intruder” to a high enough degree especially in the context of the numbers involved and the university setting. Tribunal’s Conclusion – Special category data 108. In our view UoE were obliged to deploy the exemption in section 40(2) FOIA as regards any special category data in the Report. This is because there was no evidence that relevant data subjects had explicitly consented to such material being disclosed (or any other Article 9 (2) reason applied) and thus disclosure of such personal data was prohibited by Article 9(1). 109. Therefore, as regards the reliance by UoE on section 40(2) FOIA as it pertains to special category data, it is our view that the DN was in accordance with the law and it is not our view that the IC should have used its discretion differently. Tribunal’s review- section 40(2) Personal data 110. By section 40(2) and 40(3A)(a) an absolute exemption applies if the processing of Personal Data would breach the data protection principles. These principles include: Article 5(1)(a) GDPR by which personal data is to be processed “lawfully, fairly and in a transparent manner as regards the data subject”  Article 6(1) GDPR which sets out the circumstances where processing will be lawful including:◦ (a) where the data subject gives consent (as opposed to explicit consent for special category data) ◦ (f) where processing is 29

Select target paragraph3