120. UoE sets out its case on section 40(2) from page A186 of the Bundle. In summary in their submission: in this situation there is a high risk that the mere redaction of a name will not suffice to prevent identification. They say (A191):“Various individual data subjects are named directly. Some are identifiable in the context of the Report, by reading it is a whole. Some will be identifiable from the evidence they have given as recorded in the Report, even when they are not named, because the detail of their accounts, or the references to them, will mean that others with some awareness of the context will be able to work out their identity (and consequently, inform others with the motivation to seek assistance).  disclosure of the redacted personal data would not be fair (Article 5) or necessary (Article 6(1)(f)) or justified by that Article of the GDPR. 121. As regards fairness (A192) in summary UoE says that it would be unfair to disclose personal data because:(a) it was obtained and processed in the Report on the basis of assurances of confidentiality; and (b) disclosure enabling data subjects to be identified in the context of their actions and reactions in the context of the matters discussed in the Report, and the wider trans rights debate, is likely to cause them distress, harm and abuse by third parties (in particular, on social media, which may be targeted at those individuals whether or not they are on the same social media platform). Indeed, there are relatively few matters of public debate at the present time which are more prone to inciting toxic and abusive reaction than trans rights issues. Even where the data subjects’ connection with the matters in the Report is already known, disclosure will restart and regenerate existing attacks and abuse to no positive effect. Disclosure is in this context fundamentally unfair. 122. UoE also assert that disclosure is not necessary to pursue the identified legitimate aim because:“that aim is materially addressed by the published version of the Report. The redacted portions provide, at most, some background context to the findings and criticisms made of the University; it is those findings and criticisms and recommendations which address the legitimate aim. Disclosure of personal data is simply unnecessary: it is not the least restrictive way in which the aim can be met and the Goldsmith tests are not satisfied. 123. As regards striking a balance with the rights and freedoms of the data subject UoE says:- 34