Sorry but that read like an answer from someone who doesn't wish to disclose the number.
Data protection covers the rights of individuals, not the right to disclose 'yes we have done many/hundreds/thousands of euros/transactions'.
The university is the "individual" in this instance.