"Saudia has a legitimate interest in undertaking the disclosure exercise to comply with English law obligations and court proceedings. However, as part of the Balancing Test, Saudia must only process personal data that is necessary to meet this legitimate interest and take measures to avoid harm to the relevant individuals concerned. In practice, this emphasises the Data Minimisation principle and, in practice, requires Saudia to undertake the initial filter/cull of the dataset prior to making any disclosure."