Thank you for your email received on the 4 July 2026, in which you made a request for access to certain information which may be held by the Infected Blood Compensation Authority.
As you may be aware, the purpose of the Act is to allow a general right of access to information held at the time of a request, by a Public Authority (including the Infected Blood Compensation Authority), subject to certain limitations and exemptions.
We have now had the opportunity to fully consider your request and we provide a response for your attention.
Following receipt of your request, searches were conducted with the Strategy, Design and Governance Directorate of the Infected Blood Compensation Authority. We can confirm that the information you have requested is partially held by the Infected Blood Compensation Authority.
You asked the following
I request copies of the following two central documents held by the IBCA:
- The Core Claimant Transition Protocol: The specific, finalized high-level policy document or operational framework that establishes the administrative workflow for transitioning current beneficiaries of UK Infected Blood Support Schemes (IBSS/SSP) into the IBCA compensation pipeline.
- The Inter-Agency Data Sharing Agreement: The final, signed Memorandum of Understanding (MoU) or Data Sharing Agreement (DSA) established between the IBCA and the regional support scheme delivery bodies (e.g., NHS Business Services Authority for EIBSS) specifically governing the transfer and verification of existing recipient records.
If these specific documents are held within a broader claims management manual, please extract only the relevant chapters or sections detailing this high-level transition and data-verification architecture.
Our response
We have now had the opportunity to fully consider your request under the Freedom of Information Act 2000 (FOIA) and have provided a response for your attention below.
- The Core Claimant Transition Protocol: The specific, finalized high-level policy document or operational framework that establishes the administrative workflow for transitioning current beneficiaries of UK Infected Blood Support Schemes (IBSS/SSP) into IBCA compensation pipeline.
Our response: This information is not held. - The Inter-Agency Data Sharing Agreement: The final, signed Memorandum of Understanding (MoU) or Data Sharing Agreement (DSA) established between IBCA and the regional support scheme delivery bodies (e.g., NHS Business Services Authority for EIBSS) specifically governing the transfer and verification of existing recipient records.
Our response: We have included two attached files as our response. These are our Data Sharing Agreements established between IBCA and the Infected Blood Support Schemes:
Please be aware that we have redacted some information from these documents.
Under the heading ‘Technical and Organisational security arrangements’:
The redacted information relates to the specific mechanisms used by IBCA and the Infected Blood Support Schemes to share and store data, as well as the frequency of sharing within that process.
We have established that this information is exempt under section 31(1)(a) of the Freedom of Information Act 2000 (“the Act.)
Section 31(1)(a)
Information is being withheld because it is exempt under Section 31(1)(a) of the Freedom of Information Act 2000 because disclosure would be likely to prejudice the prevention and detection of crime, namely cyber crime.
Section 31(1)(a) FOIA is a qualified exemption and therefore requires IBCA to carry out a public interest test.
Factors in favour of disclosure
We recognise the public interest in demonstrating transparency and accountability by releasing information to the public. We also appreciate that this increases public trust and that the public benefits from being kept informed about matters affecting them. Disclosing this information will help in understanding IBCAs data sharing practices and the mechanisms we use to facilitate that.
Factors against disclosure
The consequence of disclosing the ways in which information is shared and stored between IBCA and the Schemes is that bad actors would gain insight into how we utilise these services and systems. Those bad actors will then use that information to target attacks against those providers. Additionally, bad actors will utilise the information to conduct phishing attacks against IBCA and our providers.
Taking into account all the circumstances of this case, we have concluded that the balance of the public interest favours withholding this information.
Under the heading ‘SIGNATURES’
Some of the information you requested is being withheld under section 40(2) of the Freedom of Information Act.
Section 40(2) exempts personal information from disclosure if that information relates to someone other than the applicant, and if disclosure of that information would, amongst other things, contravene one of the data protection principles in Article 5(1) of the UK General Data Protection Regulation and section 34(1) of the Data Protection Act 2018.
In this case, we believe disclosure would contravene the first data protection principle, which provides that processing of personal data must be lawful, fair and transparent. We consider that disclosure of the information would contravene Principal A under article 5(1)(a) of the UK General Data Protection Regulation (GDPR), which requires that personal data should be processed lawfully, fairly, and transparently. We have considered the legitimate interests being pursued in the request and that these interests could be met only by disclosure of the information. We have found that, on balance, the legitimate interest and necessity in disclosure are overridden by the reasonable expectations of privacy of the individuals concerned.
Section 40(2) is an absolute exemption and the Infected Blood Compensation Authority is not obliged to consider whether the public interest favours disclosing the information.