SACHRP: Exempt Research May "Be Subject to IRB Review"

As reported by Erica Check Hayden in Nature, at its March meeting, SACHRP endorsed "Considerations and Recommendations Concerning Internet Research and Human Subjects Research Regulations, with Revisions," prepared by Elizabeth Buchanan and Dean Gallant. The guidance offers some common sense, but it struggles with the legacy of the poorly drafted Common Rule. And it threatens to make matters worse by suggesting that some exempt research may "be subject to IRB review."

The basic question is when can a researcher use information she finds on a website. Article 2.2 of Canada's TCPS2 offers a relatively straightforward answer:

Research that is non-intrusive, and does not involve direct interaction between the researcher and individuals through the Internet, also does not require REB review. Cyber-material such as documents, records, performances, online archival materials or published third party interviews to which the public is given uncontrolled access on the Internet for which there is no expectation of privacy is considered to be publicly available information.

The Buchanan-Gallant report falls short of this clarity. As I read it, the report gives three competing answers.

1. IRBs lack jurisdiction

The report properly notes that if a researcher does not interact with a subject or access private information, she is not conducting human subjects research. Thus, "If individuals intentionally post or otherwise provide information on the Internet, such information should be considered public unless existing law and the privacy policies and/or terms of service of the entity/entities receiving or hosting the information indicate that the information should be considered 'private.'"

The report offers helpful examples of "purely public sites" for which no IRB review is necessary:

(1) Sites containing information that, by law, is considered "public." In most cases information from these sites will be available without restriction, although access to the information may require payment of a fee. Many federal, state, and local government sites are included in this category: property tax records, birth and death records, real estate transactions, certain court records, voter registration and voting history records, etc.
(2) News, entertainment, classified, and other information-based sites where information is posted for the purpose of sharing with the public.
(3) Open access data repositories, where information has been legally obtained (with IRB approval if necessary) and is made available with minimal or no restriction.
(4) Discussion fora that are freely accessible to any individual with Internet access, and do not involve terms of access or terms of service that would restrict research use of the information.

2. IRBs might have jurisdiction

Having made these statements, the report hedges:

(b) A subject’s own expectation of privacy is not always "reasonable." A subject may assume— perhaps in ignorance—that his or her information provided or available on the Internet is private, but the first part of the regulatory definition of "private information" specifies that the individual "can reasonably [sic] expect that no observation or recording is taking place." Information that is archived online has, ipso facto, been recorded. Can it ever be reasonable to expect otherwise, absent an explicit statement that no information will be recorded?

(c) Despite (b) above, the Belmont principle of beneficence may support a more conservative approach. A subject who incorrectly assumed his/her identifiable information was private, or restricted only to a select group, might not have posted the information on some social networking site if s/he thought the information would be widely available, believing that the information could be embarrassing or damaging.

I can understand the report's caution here; there will inevitably be marginal cases about the reasonable expectation of privacy. TCPS2 offers the examples of "Internet chat rooms, and self-help groups with restricted membership." And data linkage further complicates matters. Hayden's Nature article gives the example of Andrew Gordon, a computer scientist at USC, who reads blogs by people who leave off their real name but can be easily identified "by using information from photographs that they post or by looking up the registrant of the blog’s domain name." TCPS2 offers confusing guidance on such research; article 2.2 states that "data linkage of different sources of publicly available information" triggers REB review and cross-references article 5.7, which in turn states that if "the research relies exclusively on publicly available information," data linkage does not trigger review and cites article 2.2. Hmmm.

I am perplexed, however, by the Buchanan-Gallant invocation of beneficence to justify possible IRB jurisdiction. The question here is whether the person posting the information has consented to having that information used for research purposes, and the Belmont Report presents consent as an application of respect for persons, not beneficence.

To bring beneficence into consideration invites mischief; for example, what if we were talking about information published in an unambiguously public forum, such as the letters column of a newspaper? If an IRB is allowed to assert jurisdiction over such public information on the grounds that "the information could be embarrassing or damaging," then it has become a censorship board.

3. Exempt is sometimes not exempt

Immediately following the passage quoted above ("embarrassing or damaging"), the report continues:

Should the investigator and the IRB consider the proposed research to be subject to IRB review, even if under existing regulations the research is exempt because the information is publicly available? Researchers and IRBs should consider the nature of the study and the sensitivity of identifiable data; more details about the study, and thoughtful institutional policy, taken in consideration with standard professional or disciplinary norms and practices, would help inform such decisions.

This is dreadful. If the research is exempt (or, more properly, not research with human subjects), it is not subject to IRB review, period. That doesn't stop a researcher from voluntarily seeking advice from IRB members or anyone else. But I hate to see SACHRP suggesting that exempt research is in any way "subject to IRB review." We need to keep these categories clear.

4. If the information could be damaging, IRBs do have jurisdiction

After apparently emphasizing the fact that reading people's public postings does not constitute research with human subjects, the report backs further away and hints the opposite:

If an activity (textual, visual, auditory) is legally available to any Internet user without specific permission or authorization from the individual being observed, or from the entity controlling access to the information, the activity should be considered "public behavior." Examples include "comment" postings on news sites; posting on publicly available hosting sites such as YouTube® or Flickr®; postings on classified sites such as Craigslist®; and postings on unrestricted blog or wiki sites. Information posted on social networking sites such as Facebook®, LinkedIn®, Myspace®, or similar fora, and available without restriction to any authorized user of the site, should also be considered "public behavior," even though access to the website itself may be restricted to individuals who have established an account to use the site. Note that the mere fact of an activity being considered "public behavior" does not mean that observation of the activity should automatically be considered exempt from the requirement of IRB review. Per 45 CFR 46.101(b)(2), if the information is recorded in a way that permits identification of subjects, and if disclosure of the identifiable information could "reasonably place the subjects at risk of criminal or civil liability or be damaging to the subjects' financial standing, employability, or reputation," then the research would not be exempt from IRB review.

To start with, the inclusion of registration symbols shows Buchanan and Gallant to be timid in their approach to law. Someone once told them that in some circumstances it is useful to put those symbols after trademarked names, and, rather than bothering to learn the actual rule, they have cluttered an important document.

More significantly, they have gotten caught in a trap set by the Common Rule: simple observation of public behavior is simultaneously not human subjects research (because, under 45 CFR 46.102, it involves neither interaction nor identifiable private information) and, under 45 CFR 46.101, human subjects research that is exempt from review only if it means one of two criteria: not recorded or not damaging.

OHRP's 2004 decision chart tried to sort this out. It shows that if an individual cannot "reasonably expect" that information will not be made public, "the research is not research involving human subjects, and 45 CFR 46 does not apply."

Despite this guidance, Buchanan and Gallant have chased the red herring of the exemption for public observation in 45 CFR 46.101(b)(2). As a result, they offer "Discussion fora that are freely accessible to any individual with Internet access" as not human subjects research, but "postings on unrestricted blog or wiki sites" as human subjects research that may not be exempt. This is contradictory.

5. By the way, "recorded" means "recorded by the investigator"

In addition to probing the limits of an expectation of privacy, the report addresses the Common Rule's ambiguity about when the recording of information invalidates an exemption.

The 45 CFR 46.101(b) exemptions twice address the recording of information.

Section (b)(2) exempts "of educational tests (cognitive, diagnostic, aptitude, achievement), survey procedures, interview procedures or observation of public behavior, unless . . . information obtained is recorded in such a manner that human subjects can be identified" while section (b)(4) exempts "Research involving the collection or study of existing data, documents, records, pathological specimens, or diagnostic specimens, if these sources are publicly available or if the information is recorded by the investigator in such a manner that subjects cannot be identified."

Why does "by the investigator" appear in (b)(4) but not (b)(2)? I haven't found an explanation in my research, and apparently neither have Buchanan and Gallant. While they "believe the intent of [section (b)(2)] is "recorded by the investigator in such manner . . ." they note that "Confirmation of this interpretation would be helpful." I quite agree, but, as best I can tell, rather than offering such confirmation or seeking it from OHRP, SACRHP approved their report without addressing this concern.

Rather than disentangle the issues raised in the report, SACHRP has added to the clutter.