The proof of the pudding is in the eating. When the Freedom of Information (Scotland) Act came into force, it was hailed as the advent of a new era.

Out went the old culture of public bodies releasing information parsimoniously on a "need to know" basis, in favour of the public's right to know. For the first time, the public sector was to be obliged to make a case for withholding information.

If there was a "but" about this new transparency it concerned the growing band of private companies and not-for-profit operators delivering services and undertaking building projects for public authorities. One of the biggest had been the private finance initiative (PFI) contract signed between the Royal Infirmary of Edinburgh NHS Trust and Consort Healthcare Ltd to build and run the new ERI at Little France on the edge of the capital. Worth £1.2bn over the lifetime of the contract, it was attracting controversy before a brick was laid. A report in the British Medical Journal in 2003, a year after it opened, claimed the high costs of using the PFI mechanism had gone hand in hand with a dramatic fall in the number of beds.

Within a month of the new act being implemented in January 2005, a request had been made under Freedom of Information to release the contract for this project. Today we learn that Scottish Information Commissioner Kevin Dunion made 10 separate approaches to NHS Lothian asking it to justify its blanket refusal on the grounds of commercial confidentiality to release any of the information. He has now given the health board 45 days to produce it. If this adjudication stands it means that public bodies hoping to hide from public accountability behind a cloak of commercial secrecy will have to think again.

It is significant on two levels. First, it shows the onus is on public bodies to make a case for keeping certain information secret. NHS Lothian failed to do this in several ways. More than 5000 pages of the contract documentation only came to light late in the investigation. No justifications were offered for any exemptions from the Act, let alone the claim that the entire contract should be kept secret.

Secondly, there is a wider issue about how the public right to know is protected when public services are delivered by private or not-for-profit organisations. If Freedom of Information is to do what it says on the tin, the default position for public bodies, which are under the terms of the Act the holders of the information requested, must be that everything should be released, except where an argument can be made for keeping specific portions of a contract confidential. Merely asserting, as NHS Lothian did, that the contractor believed release of information would be an actionable breach of confidence is no justification for keeping the public in the dark. This principle should apply not only to PFI contracts but any contract between a public body and a contractor. If the public has a right to know in principle, the same should apply in practice to the enterprises it funds.