Home Decisions

Decision 218/2025

Decision 218/2025: Transaction data 


Authority: East Lothian Council 
Case Ref: 202500792
 

Summary

The Applicant asked the Authority for details of all transactions made by the Authority over £500 from January 2016 to September 2024.  The Authority disclosed information in response to the Applicant’s request, but she considered that certain information had been omitted.  During the investigation, the Authority confirmed that it had not omitted this information and that it wished to rely on relevant provisions in FOISA to refuse to provide it to the Applicant.  The Commissioner required the Authority to issue the Applicant with a revised review outcome in which it must fully explain its position (and set out any relevant provisions in FOISA it wished to rely on).

Background

  1. On 4 November 2024, the Applicant made a request for information to the Authority.  She asked for information relating to the date, value and recipient of all transactions made by the Authority over the value of £500 from January 2016 and September 2024.  
  2. The Authority responded on 3 December 2024 in terms of FOISA.  It disclosed information in response to the Applicant’s request. Owing to the large size of the information disclosed, it provided the Applicant with details of a file sharing website (Objective Connect) on which this information would be hosted, as well as instructions detailing how to access and download the files.
  3. On the same day, the Applicant wrote to the Authority requesting a review of its decision. She stated that she was dissatisfied with the decision because the information disclosed by the Authority did not include “supplier details”.  She asked the Authority:  

  • if it would be feasible to provide supplier details only for transactions made to businesses or organisations, excluding payments to individuals

  • if it was unable to identify suppliers automatically, whether it could suggest a manageable timeframe or subset of data for which supplier details could be reviewed and provided.

  1. The Authority notified the Applicant of the outcome of its review on 23 December 2024.  It stated that the “supplier details” were “within column B ‘Vendor Name’ of the file shared with [her] in response to [her] request”.  It therefore concluded that its original response was appropriate and had satisfied her request.
  2. On 14 January 2025, the Applicant wrote to the Authority to say that she was unable to locate a column labelled “Vendor Name” or any information that corresponded to supplier details.  She asked the Authority to:

  • confirm if this column had been included in the information shared to her and, if so, to provide her with guidance on where to locate it

  • share a corrected version of the files with her if the data had been omitted inadvertently

  1. Having not received a reply from the Authority, the Applicant again wrote to the Authority on 17 February 2025 and 16 May 2025 to ask for a response to her email of 14 January 2025.
  2. On 16 May 2025, the Authority responded to the Applicant.  It noted her comments and said that, as she was dissatisfied “with the information [the Authority] had provided following the internal review”, the next step for her should be to appeal to the Scottish Information Commissioner.
  3. On the same day, the Applicant wrote to the Commissioner, applying for a decision in terms of section 47(1) of FOISA.  She stated she was dissatisfied with the outcome of the Authority’s review because it said that the dataset provided to her included supplier names in “Column B” under “Vendor Name”, but the files she received did not contain this column or any supplier-identifiable information

Investigation

  1. The Commissioner determined that the application complied with section 47(2) of FOISA and that he had the power to carry out an investigation.
  2. On 28 May 2025, the Authority was notified in writing that the Applicant had made a valid application.  In doing so, the Commissioner asked the Authority to consider the apparent discrepancy between its position in its review outcome that the supplier details had been provided to the Applicant and the Applicant’s position (expressed on three occasions following the review outcome) that this information had not been provided to her.
  3. The Authority confirmed that it would investigate this.  Having done so, it explained that it believed that its review outcome had mistakenly been based on the full data extract rather than the data disclosed to the Applicant as part of its initial response.  It said that it was not in a position to disclose this information to the Applicant and that it would provide submissions to the Commissioner when invited to do so.
  4. The case was subsequently allocated to an investigating officer.
  5. Section 49(3)(a) of FOISA requires the Commissioner to give public authorities an opportunity to provide comments on an application.  The Authority was invited to comment on this application and to answer specific questions regarding its handling of the request and its position regarding the information the Applicant believed had been omitted.

Commissioner’s analysis and findings

  1. As stated above, the Authority was invited this application and to answer specific questions regarding its handling of the request and its position regarding the information the Applicant believed had been omitted.
  2. The Authority acknowledged the errors in its review outcome which, as stated above, was mistakenly based on the full data extract rather than the data disclosed to the Applicant.
  3. The Authority’s initial response did not indicate, when read in isolation, that it had withheld any information from, or refused to provide any information to, the Applicant.  However, the Authority provided a copy of a letter that it separately shared with the Applicant via the Objective Connect website that it had uploaded the disclosed information to.  This letter stated that:

  • the Authority was unable to provide details of the recipient or description of the goods/services purchased because, although most payments were made to business, occasionally they were made to individuals.  It said that it was withholding information relating to individuals under the exemption in section 38(1)(b)

  • the Authority considered redacting any personal data from each transaction line, but to do so would take around 400 hours and cost around £6,000.  It stated that, under section 12 of FOISA, it was not obliged to comply with a request where it would cost more than £600 to do so.

  1. The Authority stated that it wished to rely on this “original refusal to disclose recipient data due to the excessive costs associated with the redaction of exempt information”.  In addition to personal data, the Authority said that the full data set included a significant number of payments relating to current Authority contracts – stretching over the last nine years.
  2. The Authority said that this information would also require to be reviewed by senior legal advisers to redact any information that would constitute an actionable breach of confidence in terms of section 36(2) of FOISA.  It submitted that this would add significantly to the time required to prepare the information for disclosure and that it therefore considered the initial indications of costs to be a “significant underestimate”.
  3. The grounds of dissatisfaction set out in the Applicant’s application were restricted to her dissatisfaction with the Authority claiming that it had provided her with the supplier details in “Column B” under “Vendor Name” when the information provided to her did not contain this information.  The Applicant did not know, at the time of making her application to the Commissioner, that the Authority had not simply omitted to provide her with the information but that it instead wished to rely on provisions in FOISA to refuse to provide it to her.
  4. Given this, the Commissioner requires the Authority to provide the Applicant with a revised review outcome (in terms of section 21 of FOISA), which must fully explain its position (and set out any relevant provisions in FOISA) in relation to the supplier details information.  This will enable the Applicant to, if necessary, make a new application in which she can fully challenge the Authority’s reasons for refusing to provide this information to her.
  5. If, as is likely, the Authority intends to refuse to comply with the request in terms of section 12(1) of FOISA, then it should ensure the revised review outcome sets out the projected costs of complying with the request.
  6. The Authority should also provide the Applicant with advice and assistance, in line with its duty under section 15 of FOISA, on how she might narrow the scope of her request or otherwise refine it to allow her to obtain at least some of the information.  In providing such advice and assistance, the Commissioner requires the Authority to consider the options suggested by the Applicant in her requirement for review (set out at paragraph 3).

Handling of the request

  1. In the circumstances, the Commissioner must comment further on the Authority’s handling of the request.
  2. The purpose of the review stage is to allow a public authority the opportunity to reconsider the substance and content of the initial response.  It is therefore unsatisfactory that the Authority’s review outcome in this case was mistakenly based on the full data extract rather than the data disclosed to the Applicant.
  3. The Commissioner would urge the Authority to take care when issuing review outcomes to ensure that they are based on the correct information and that they adequately respond to the dissatisfaction raised in the requirement for review.

Decision 

The Commissioner finds that the Authority failed to fully comply with Part 1 of FOISA in responding to the information request made by the Applicant.

Specifically, the Commissioner finds that the Authority’s review outcome failed to provide the Applicant with adequate justification for its refusal to disclose certain information. 

The Commissioner requires the Authority to provide a revised response to the Applicant’s requirement for review, in terms of section 21 of FOISA, by 31 October 2025. 

Appeal

Should either the Applicant or the Authority wish to appeal against this decision, they have the right to appeal to the Court of Session on a point of law only.  Any such appeal must be made within 42 days after the date of intimation of this decision.

Enforcement 

If the Authority fails to comply with this decision, the Commissioner has the right to certify to the Court of Session that the Authority has failed to comply.  The Court has the right to inquire into the matter and may deal with the Authority as if it had committed a contempt of court.

 

Cal Richardson 

Deputy Head of Enforcement 


16 September 2025