Some researchers view IRB concerns as an impediment to data sharing, even those researchers who understand the many benefits of sharing. However, IRB concerns and recommendations around data sharing vary depending on the specific type of data being shared. Moreover, best practices for seeking informed consent are widely available, thereby properly protecting participants.
Different types and levels of data sharing are associated with different ethical concerns. It is useful to distinguish among different use cases, and the types of concerns raised around data sharing.
Using data shared by others ("secondary use") usually involves lower risk to participants because the new study does not involve contact with the participants. However, the level of risk depends on the nature of the data, whether the data are identifiable or otherwise sensitive, and the sort of permission that participants initially granted for sharing. Reuse of existing shared data is common practice, so most IRBs have established procedures for determining the level of risk posed by a particular project involving secondary use. For example, many IRBs deem exempt from review projects that involve the secondary use of non-sensitive, de-identified data.
What's new, less common, and a potential source of concern to IRBs is the push by investigators under their supervision for more widespread sharing of certain types of data. This push means that PIs and their IRBs must evaluate the risks of sharing data within each particular study. Doing so requires determining what data can be shared, with whom and how, and with what level of risk. The risk of identification raises special concern. Fortunately, practices about what personal identifiers should be eliminated from data files are well established (even in brain imaging), so in many cases, de-identifying data files is uncomplicated. In cases where researchers seek to share sensitive or identifiable data (such as unaltered video or audio recordings that might contain participants' faces, voices, or audible names), establishing guidelines on restriction of access is essential. Sharing these sorts of data increases risks to participants, and therefore explicit permission to share must be sought, with participants being fully informed of the meaning of "shared data" and who will have access.
Choices about how PIs should share data and who should have access are complicated. PIs or IRBs may be under the mistaken impression that shared data should (or must) be publicly available to meet open science standards, or journal or funder mandates. In fact, some of the most successful examples of data sharing in psychological research involve restricted access, where data are stored in recognized data repositories that limit access to approved researchers. Public access may be appropriate for some datasets, but it should not be the standard to which all studies must be held.
It is critical to seek explicit permission from participants to share data and to be transparent about the uses of those data. This honors participants' autonomy by ensuring they (and/or their caregivers) fully understand the risks of sharing the data they contribute – as well as the potential benefits to science and the community at large that they are granting by sharing.
Psychological science has a long history of data sharing, and researchers can learn best practices from existing resources. In developing institution- or project-specific language for consents and data sharing permissions, PIs and IRBs can draw on the collective experience of experts and data repositories that have experience sharing data from vulnerable populations, such as children. Sources that provide valuable guidance about how to seek informed consent and data sharing permission, including template language, include:
- Databrary;
- Child Language Data Exchange System (CHILDES);
- Inter-university Consortium on Political and Social Research (ICPSR); and
- Open Brain Consent project.
Several of these organizations are collaborating on developing template language and data sharing procedures that will make these provisions even more consistent in the future.
The IRB review plays a vital role in ensuring that standard consent, data management, and data sharing practices used for primary data collection enable future secondary uses while minimizing the risks to the original participants. Anticipating the questions that will be raised by IRBs and knowing how best to respond will enhance the likelihood of your IRB granting permission for data sharing. For example, in reviewing data sharing plans, IRBs may raise several practical questions that require an explicit response. For example:
Q. Must minors be re-consented when they reach the age of majority?
A. Federal officials say not if re-consenting is impractical or otherwise increases risks to participants (e.g., by requiring researchers to maintain links between identifiable information and collected data for extended time periods).
Q. Must data be destroyed after a particular time period?
A. Not if they are stored indefinitely in a recognized repository (as should become standard practice); data destruction is not mandated under federal regulations.
Because IRBs are concerned with participants being fully aware of what they are sharing, it is best practice to request participants' consent to share after they have participated in a study, and therefore know exactly what data were gathered. Most developmental research is innocuous, and most parents are willing to share their children's data – including video recordings – after they see that the project was fun and their children enjoyed participating. Most parents of children with disabilities are willing to share their children's data because they hope to speed progress in research.
We have drafted template language to assist you in completing your IRB applications here.
As stated in the [Databrary Access Agreement(|filename|(agreement.md))], in order to access Databrary, we require that authorized investigators:
- Belong to an institution that maintains an ethics or Institutional Review Board with U.S.-equivalent standards that reviews and approves research involving human subjects;
- Have current research ethics training that addresses human subjects policy and issues; and
- Are eligible to conduct independent research at their institution.
The purpose of the first two requirements is to ensure that data shared on Databrary are collected in an ethical manner, with appropriate informed consent procedures, and that further research conducted using those data follows the same ethical guidelines. In general, Databrary has kept the specific language regarding ethics broad, to accommodate local norms and ethical standards.
However, there is a minimum standard of ethics oversight that remains a core requirement for Databrary access. Researchers have joined Databrary and shared their research data with this as a fundamental principle, and our funding sources (NIH and NSF) require human subjects oversight. Because of this, regardless of local norms regarding ethics boards, Databrary will not authorize researchers without human subjects oversight to have access to Databrary. This is particularly an issue in foreign countries with different research norms and customs.
To ensure the requirements of the Databrary Access Agreement are met, Databrary will require researchers whose institutions do not have human research ethics review committees which provide equivalent protections to those promulgated by the United States to obtain a Federalwide Assurance (FWA) before applying for access to non-public content in Databrary (see: https://www.hhs.gov/ohrp/register-irbs-and-obtain-fwas/index.html).
In requiring researchers without institutional ethics oversight to obtain an FWA, Databrary is both upholding our agreement with data contributors, and placing a minimal burden on these researchers. We are aware that there is a non-institutional, or less formal, system for monitoring ethical human subjects research in some countries:
| Germany | Oversight only required for sensitive research (e.g., HIV, genetics) |
| Poland | Oversight external to the institution, by regional and central ethics boards |
| Sweden | Oversight external to the institution, by regional ethics boards |
Databrary staff are happy to work with researchers in these countries to find workable solutions.