Freedom of information warning for Welsh Government
The Information Commissioner says the Welsh Government should review the way it handles freedom of information requests.
The commissioner also ruled information relating to a partly critical report on the NHS should have been disclosed.
The new Conservative assembly leader, who waited seven months for a "substantive" response to a question, said it raises issues of transparency.
The Welsh Government will consider the ruling.
The commissioner upheld a complaint by Conservative assembly leader Andrew RT Davies who made a freedom of information request about a report by management consultants on the NHS.
Mr Davies asked to see emails, letters and details of meetings between then Health Minister Edwina Hart or her officials and the management consultants McKinsey & Company.
McKinsey produced a document for the Welsh Government which criticised some aspects of the running of the health service.
Mr Davies made his request in June 2010, but did not get a "substantive" response until January this year. The Information Commissioner noted concern at the time taken to provide a response.
The Commissioner found that "public interest favoured disclosure" of other information which the Welsh Government withheld about the reform and restructure of its health and social services department.
Last September Mrs Hart denied suppressing McKinsey's findings, saying the company had produced a "discussion document", not a report.
Mr Davies, his party's health spokesman at the time of the request, said the Commissioner's findings called into question the transparency and accountability of the Welsh Government.
"This ruling makes it clear that the former health minister did not act in the public interest," he said.
"At a time when the Welsh Assembly Government was furiously defending its position on the McKinsey 'report' - and whether or not it existed - their transparency and accountability were plainly questionable.
"This ruling raises serious questions over the way the previous minister - and her government - dealt with the McKinsey analysis. Its findings caused widespread concern amongst health professionals and it should have been treated with the utmost importance."
The Welsh Government was given 35 days from 18 July to disclose the withheld information, but it also has 28 days from that date to appeal the decision of the Information Commissioner.
A spokesman for the Welsh Government said it "will consider the content of the judgement and respond to the Information Commissioner's office in due course".