Richmond officials have republished several years of data showing City Hall’s financial transactions after The Richmonder filed a Freedom of Information Act request asking for the information.

The city has not been following a transparency law the City Council passed in 2015 that requires the routine publication of a payment register showing how public funds are spent.

Officials complied with the payment register law for about four years, but stopped publishing new data in 2019. They also took down the old data in 2024 out of fear it might contain confidential or private information that wasn’t caught in the initial review process.

Mayor Danny Avula’s administration is still pointing to those concerns, saying they prevent the government from complying with a law meant to help assure Richmond taxpayers that public funds are being spent wisely. Because the data can contain sensitive or confidential information, city officials have said it takes an enormous amount of manual staff time to review it and make redactions.

The older dataset the city recently published  — which runs from fiscal years 2016 to 2019 —  shows a vast array of financial transactions, ranging from a $55 million debt service payment to a $600 paint job for a bathroom in the mayor’s office to a $55 cookie tray for a Council member’s district event.

While much of the data might not be particularly interesting to city residents who aren’t looking for something specific, the payment register enables the public and the press to research city spending patterns without having to file FOIA requests, which can also eat up city staff time and resources.

The publication of the old data suggests the city has at least some capacity to do the work necessary to safely post the information, although the old data likely required less work because it had already been reviewed and published before. The city said it expects to publish fresher, unreviewed data from fiscal year 2025 “in the coming months.”

The payment register has become part of a larger debate about City Hall’s’ commitment to transparency, as well as the executive branch’s tendency to occasionally ignore legally binding policies enacted by the legislative body.

Councilor Kenya Gibson (3rd District) is pressing the issue by introducing a rare oversight resolution asking the Council to investigate the city’s failure to publish the payment register. 

Gibson was set to present that proposal at a Council committee meeting Monday. However, that meeting was cancelled as many city officials travel to Phoenix this week for ChamberRVA’s Intercity Visit. It’s unclear when the proposal will be docketed for a hearing, but the Council’s next meeting is on May 11.

Avula, who made transparency a major theme of his mayoral campaign, has proposed scaling down the 2015 law to narrow what the city is required to publish. By publishing a less-comprehensive financial register that’s more in line with what other local governments disclose, Avula has said, the city can achieve the goal of transparency without devoting an unwarranted amount of resources to it. 

Under Avula’s proposal, the payment register would show how much money the city spends with each vendor providing goods and services and list reimbursements to city employees for work expenses. It would no longer include payments to individuals, and it would exclude dates and invoice descriptions for all payments.

With Avula’s proposal to slim down the payment register also pending before the Council, the body faces a choice between insisting that the administration follow the existing law or walking back the law to make the register less thorough but easier on the city’s staff.

City points to social security numbers found in data

The Richmonder had asked for the old data on April 13 as part of a FOIA request that was originally submitted March 10. After obtaining a copy of the old data from someone who downloaded it when it was still available on the city’s website, The Richmonder asked the city several follow-up questions about how privacy concerns were handled when the city was routinely publishing the data.

After reminding the city of the pending FOIA request, The Richmonder gave officials a deadline of 5 p.m. Thursday to respond to the questions. In a news release sent out at 5:41 p.m. Thursday, the city announced it had published the old data again after re-checking it for sensitive information.

To bolster their case the privacy concerns are well-founded, officials said they used AI to find and remove around 60 social security numbers discovered in about 747,000 rows of data.

“The city pulled these datasets down during the last administration due to legitimate, and now-proven, security concerns,” Chief Administrative Officer Odie Donald II said in a news release. “Today, we’re safely reposting the data, and we’re incredibly excited to have introduced new legislation that will prioritize transparency AND protect privacy.”

The newly discovered social security numbers were all related to one type of payment, but officials could not immediately explain what type of invoices contained the numbers.

The city also discovered some employer identification numbers (EINs) in the old data, which businesses use for tax and payroll purposes. While generally not considered as private as social security numbers because they’re linked to a business instead of a person, officials said EINs can be considered sensitive “depending on the context.”

After emphasizing manual process, officials say they also did ‘formulaic editing’

Some of the privacy concerns officials have raised this year appear to have been at least partially addressed in the old payment register format. Officials have said the old register risked exposing payments to people receiving social services assistance, as well as wage garnishments showing when someone’s pay was docked for an outstanding debt.

The old data indicates many of those types of transactions were already being anonymized and protected, apparently through the use of common data-sorting techniques.

Throughout the dataset, social services payments repeatedly show up as going to an unidentifiable “Social Services Provider.” Invoice descriptions for those types of payments were stripped out using the same boilerplate redaction language. Officials confirmed the city was able to automatically shield some of the social services data that — according to Avula’s team — poses the greatest legal risk for the city.

Wage garnishments also appeared to be routinely anonymized, though it’s not clear if that process was automated, manual or some combination of both.

Going forward, Avula has proposed excluding payments related to legal settlements and legal claims out of concern sensitive information related to lawsuits could be revealed. In the old format, many of those payments were anonymized, only listing a client or case number. Some claims and settlement transactions show lump sums of money being paid out through the city’s risk management vendor, without enough detail to identify the ultimate recipient.

In response to The Richmonder’s questions, city spokesman Ross Catrow acknowledged the city had the ability to use invoice codes and account numbers to automatically redact some sensitive information in the old format. But he said there was also a manual element involved. And he did not back down from the administration's position that even with some automation in place the payment register can’t be published without extensive manual review.

“As we’ve said, multiple times, the 2015-2019 data was already reviewed through a manual and automatic process,” Catrow said. “Despite that, using new AI tools on that dataset still found more information that needed to be scrubbed.”

Asked if he could quantify how much of the sensitive data published in the old payment register was protected through automatic processes versus manual review, Catrow said he would have to check with the city’s IT staff.

That question would likely be a key focus of the Council investigation being sought by Gibson, a first-term Council member who has made a habit of challenging the Avula administration on transparency issues.

The Richmonder’s original FOIA request sought a year’s worth of more recent payment register data. In response to the initial request, the city said it would cost at least $5,732.40 to proceed, even though the city is legally required to publish the data.

The city later walked back that FOIA charge, and The Richmonder revised the FOIA request to only seek older data the city had already reviewed. 

Gibson cited the initial FOIA charge in her request for a fuller investigation.

In a statement, Gibson said she was “thankful” the city had chosen to release the old data online. An initial look at it, she said, raised more questions about the extent of the redactions and whether they’re necessary.

“I introduced a resolution that would allow City Council to exercise its oversight authority under the city charter, review the data directly and confirm that the city is being as transparent as possible in how public funds are spent,” Gibson said. “I hope a majority of my colleagues will support this effort to strengthen accountability and reinforce public trust. I think it’s long overdue.”

Some of the redactions in the old data appear to have little to do with the types of sensitive information officials have pointed to as barriers to publishing a full payment log. For example. several expenses related to law enforcement conferences — including items listed as “OCEAN CITY JOB FAIR,” “EQUITY CONF,” and “LAW CAREER FAIR” — don’t show where city money went. Instead, the vendor name for those items is listed as “Redacted by Police.”

In a memo last month, Avula told Gibson that in order to give her the city’s FY25 payment register data, which Gibson had requested as part of the city’s budget process, city staff would have to manually review and potentially redact around 200,000 invoice descriptions. A review of that magnitude could take until October to finish, Avula told Gibson.

Gibson questioned why it would take that long if the city was able to republish several years of data relatively quickly.

“We shouldn’t have to wait until October to receive current datasets that are required to be published by law,” Gibson said.

Though the Avula administration has characterized Gibson as a lone crusader pushing for immediate action on the payment register, another Council member said he too has been “hounding” the mayor on the issue.

Councilor Andrew Breton (1st District) said in a recent constituent newsletter that after discussing the matter with Avula, he was willing to give the administration time to figure out a payment register fix. With respect to the mayor’s proposal, Breton said he doesn’t believe the Council “should accept a watered-down version as a substitute.”

“This may have been the result of a rushed proposal due to outside pressure, but I believe it hurts their credibility,” Breton wrote. “I don’t support a plan that keeps so much information from being proactively published.”

Breton later told The Richmonder his thinking has changed somewhat and he no longer believes the proposal hurts the credibility of Avula’s team. He said he’s confident the Council and administration can work together to find a solution, but “the current proposal isn’t there yet.”

Contact Reporter Graham Moomaw at gmoomaw@richmonder.org