Internet research raises data storage, informed consent issues

Few IRBs have policies for Internet studies

Internet research has been an issue for IRBs since its roots in the 1990s, and the challenges ethics boards face in reviewing such studies are in pioneer territory.

For instance, twelve years ago, IRBs might not have known how to handle informed consent for studies that involved interviewing people met through Internet chat lines. Now the problems have evolved to determining how to protect research subjects when private Internet research information suddenly becomes public, says Elizabeth Buchanan, PhD, director of the center for information policy research in the school of information studies at the University of Wisconsin in Milwaukee, WI.

"I've sat on two different IRBs, helping them understand the complexities of Internet research," Buchanan notes. "One was a medical school board and one was a social science board, and there are different ways of thinking about the issues from the different disciplinary models."

Buchanan decided to study this issue by surveying IRBs in the United States. Her project was funded through a grant from the National Science Foundation.

"No one had been looking empirically at what was happening," she says. "IRBs are seeing more online surveys and interviews, but the boards don't talk to each other about it and there's a real gap in the literature base and understanding of what is happening at the national level."

Buchanan and co-researchers spent a year surveying IRBs and received more than 300 responses that formed an interesting dataset of how IRBs were handling Internet research.

Based on 2007-08 data, the study found that about half of the IRBs surveyed considered Internet research a concern or of interest to their boards. The study also found that less than 8% of IRBs had Internet research protocols, including checklists, review tools, policies, and guidelines. Another 17% said these protocols were under development, according to study findings presented at Office of Human Research Protection (OHRP) Research Community Forum 2010, held May 21, 2010, in Chicago, IL.

"IRBs are starting to get more and more of these Internet studies, and the most frequent are Internet survey tools," she says. "Some boards are more comfortable with these than others."

Plus, IRB members might find Internet research somewhat confusing, and the issues that concern them are varied.

Online consent

For example, one issue is how investigators might gain consent online. Should they use a checkbox that is similar to an iTunes or software company disclosure that asks you to read the rules and then check the box saying you approve and will proceed?

"Is that an acceptable model of consent?" Buchanan says. "Some IRBs say, 'Yes,' and some say, 'We don't know.'"

And if a checkbox consent form isn't acceptable, then what alternative do researchers have?

Other major issues involve privacy, data ownership, and terms of service.

Buchanan outlines these other ethical issues in Internet research:

Is it possible to have an equitable or fair representation in subject pool when most subject selection is based on type of site?

How does the researcher enter the research space to begin recruiting?

What if some people in a community agree to consent to the study, but others do not? Do researchers have plans for this reality?

With Internet research there are more unknowns in the area of data control, Buchanan notes.

"Suppose a researcher wants to study Facebook data," Buchanan explains. "Those data do not belong to individuals on Facebook or the researcher — they belong to Facebook."

In this type of case the stock phrases informed consent documents might include — about how the data will be kept confidential in a storage file for a set period of time and used only for research purposes — do not apply, she adds.

"We can't use that language anymore because we can't make those assertions," Buchanan says.

If the research involves obtaining answers to questions given online and through the Internet, it is reasonable to assume those answers will exist beyond the researcher's hard drive.

Internet research is subject to cloud computing: "When we store things offsite, we may have a copy of the data on our desktop, and that's well and good," Buchanan says. "But there may be another set of data in the clouds, and we don't know how long that will last."

For instance, when an investigator conducts an observation online or interacts with a specific Internet community, the researcher will generate a log or transcript, keeping a copy, Buchanan says.

Participants and the Internet community's administrator also will have a copy of the interaction. So the questions that an IRB will have to address are as follows:

  • Who owns the information?
  • How long will the e-data last?
  • Has the researcher informed participants about the data's longevity and potential risk of data intrusion?

A quick study

This uncertainty puts a burden on researchers and IRBs to learn the new Internet rules quickly.

"Researchers and IRBs need to learn and adopt new languages to protect themselves and subjects," Buchanan says.

IRBs also might encounter research collection methods that begin to cross ethical boundaries.

For instance, Buchanan has encountered the case of a researcher who wanted to learn more about people's online political views. He proposed studying this by creating a fake Internet persona with which he'd befriend people in an online community.

"He wanted to know how people would express their political views on Facebook," she says. "It was a form of deception where the researcher would present himself as someone different so he could look at the interactions."

On the surface, an IRB might ask if this would even qualify as human subjects research, she notes.

"One could argue, depending on the type of research, that the researcher could have just been looking at language," Buchanan says. "So maybe it's doing a content or discourse analysis and is not human subjects research."

And even if an IRB decides this is not human subjects research, what about the issue of deception, the researcher creating a fake persona to obtain information that was intended for a specific audience, she adds.

"The IRB was unsure if this fell into the realm of deception and how to evaluate it," Buchanan says. "However, the researcher could say, 'If you don't allow me to create this fake persona, then I won't be able to get the responses.'"