together information to identify individuals but it highlighted that they actually would take the time to do so” (d) we accept Mr Morris' evidence that the review of the Report for these purposes was carried out on a line by line basis and meticulously. We note that in so doing he was aware of the need to ensure redactions were limited to that needed to “render the individual unidentifiable, whenever this can be done.” (e) in our view UoE were right to be on high alert to the issues that could well arise for individuals if their personal data in the Report was to be disclosed. (f) from the evidence we concluded that UoE properly considered the personal data in the Report by reference to the data protection principles and in particular the need for any disclosure to be lawful (by reference to Article 6(1) (f)), fair and transparent as regards the data subject impacted in each case. (g) we accept UoE’s submission on fairness as set out at page A192 para 61 where the relevant personal data had been obtained in the manner described. (h) we agree that the Appellant was pursuing a legitimate interest. (i) we accept the Appellants submission that (f) “there is a pressing social need to know the details of the Events that took place at the University of Essex that are recounted in the Report...” (j) it was not necessary for these purposes for the redacted personal data in the Report to be disclosed because the legitimate interest was satisfied by the publication of the Report in its redacted form which included importantly the recommendations (from E569). 129. We carried out a review of the Report and Table to verify the use of section 40 by UoE and having regard for example to the classes of data identified by the Appellant and the other submissions. From our review the data redacted in reliance on section 40(2) FOIA in the Report is personal data. Appropriate levels of redaction were applied to prevent the identity of individuals being discoverable. There was at least one example (paragraph 22 on page 8) where we wondered whether a slightly lesser redaction would have still afforded enough protection but we were satisfied that UoE had considered this carefully and we could see that lesser redaction would have presented a risk of disclosure. 130. Even if we had been of the view that disclosure was necessary for the purposes of the legitimate interest it would have been our conclusion that those interests were “overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data” 37