“...necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.” 111. In the Request the Appellant said (B265):- “I am requesting an unredacted (except for the deletion of individuals’ names) copy of the [the Report]” and (B265):“I fully understand that some extremely limited redactions are necessary to protect the privacy of individuals who gave evidence or who were named in that evidence. I have no objection to the deletion of individuals’ names” 112. The DN reviewed UoE’s use of section 40(2) FOIA from A8. In summary this set out that: the information redacted by reference to this exemption is personal data which relates to and identifies the individual concerned.  processing of such data must be in accordance with the data protection principles including Article 5(1)(a) GDPR which requires disclosure to be lawful, fair and transparent in relation to the data subject.  it is agreed that there are legitimate interests in this case.  disclosure of the personal data is not necessary to further the legitimate interests as a result for example of the publication of the Report with its existing redactions. 113. The DN went on to set out the IC’s analysis of the balance between the necessity for the legitimate purpose and data subjects rights and freedoms as if it had concluded necessity had been found. (A14). The IC says:74 It is necessary to balance the legitimate interests in disclosure against the data subject’s interests or fundamental rights and freedoms. In doing so, it is necessary to consider the impact of disclosure. For example, if the data subject would not reasonably expect that the information would be disclosed to the public under FOIA in response to the request, or if such disclosure would cause unjustified harm, their interests or rights are likely to override legitimate interests in disclosure. 75. In considering this balancing test, the Commissioner has taken into account the following factors: the potential harm or distress that disclosure may cause; 30