whether the information is already in the public domain; whether the information is already known to some individuals; whether the individual expressed concern to the disclosure; and the reasonable expectations of the individual. 76. In the Commissioner’s view, a key issue is whether the individuals concerned have a reasonable expectation that their information will not be disclosed. These expectations can be shaped by factors such as an individual’s general expectation of privacy, whether the information relates to an employee in their professional role or to them as individuals, and the purpose for which they provided their personal data. 77. It is also important to consider whether disclosure would be likely to result in unwarranted damage or distress to that individual. 114. The IC concluded that the balance favoured non disclosure and therefore UoE was entitled to withhold the information by section 40(2) and 40(3A)(a) FOIA. In support of this conclusion he cites these factors: the majority of the report is in the public domain, but not all of it.  some of the withheld information may be known by some individuals for example those involved in the events discussed in the report -but it would not be known more widely.  the subject of the report was “febrile, contentious and sensitive in nature.”  those taking part were told their contribution would be confidential.  there would have been a reasonable expectation that their personal data would not be disclosed to the world at large in response to a FOIA request.  disclosure of the redacted personal data would cause “those individuals a good deal of distress” 115. In the GoA (A40) the Appellant said:- “My FOI request specifically permitted the redaction of individuals’ names and other identifying information. The first question to be posed with respect to each particular item of information in the Report is therefore: Is the individual still identifiable after the deletion of names and other identifying information?” 116. As regards other personal data he refers to Article 6(1)(f) GDPR. He notes the agreement about the legitimacy of the purpose then says as regards necessity (A49):- 31