“Section 40(2) of the FOIA provides that information is exempt from disclosure if it is the personal data of an individual other than the requester and where one of the conditions listed in section 40(3A)(3B) or 40(4A) is satisfied. 19. In this case the relevant condition is contained in section 40(3A)(a). This applies where the disclosure of the information to any member of the public would contravene any of the principles relating to the processing of personal data (“the DP principles”), as set out in Article 5 of the UK General Data Protection Regulation (“GDPR”).”
“processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”