Procurement and Freedom of Information

As a Scottish public authority, the University of Edinburgh must comply with the Freedom of Information (Scotland) Act 2002 (FOISA) and the Environmental Information (Scotland) Regulations 2004 (EISR). Both laws give members of the public and companies the right to access information held by the University.
This means that information about a supplier’s dealings with the University, including any contract, may be published or disclosed in response to a request.

However, the right to access information is subject to a number of exemptions:
•    Commercial Interests – where disclosure of information would substantially prejudice the commercial interests of a supplier.
•    Confidentiality – where disclosure of information received by a supplier would be an actionable breach of confidence.
•    Personal Information – where disclosure of an individual’s personal data would breach the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA 2018).

Where an exemption applies, the information may still need to be disclosed if it is in the public interest to do so. Requesters also have the right to challenge any non-disclosure decisions we make by submitting an appeal to the Scottish Information Commissioner. This means that the University cannot guarantee that information will not be disclosed.

If a supplier wants the University to treat information as commercially sensitive or confidential and withhold it from disclosure, it should tell the University at the time of providing the information. It is important that suppliers explain exactly what information they consider sensitive and confidential, why they consider it so and for how long. Personal data will only be disclosed in limited circumstances (for example if the information is already in the public domain).

The University may consult a supplier to seek their view about the disclosure of information that relates to them. If the University contacts a supplier about a request, it is important that the supplier replies as soon as possible. The University must respond to requests within 20 working days and if a supplier does not respond the information may be disclosed.

For more information contact Information Compliance Services.