Differentiating “Public” and “Private” Internet Spaces in IRB Review

What is the difference between “public” and “private” internet spaces? This question has gained importance with the growing practice of using internet and social media platforms as a source of research data. According to a Common Rule exemption criteria, “research uses of identifiable private information” (including information found online) are exempt from typical Common Rule protections, such as full board or expedited IRB review, if such information is “publicly available” (45 CFR 46.104[4][i]).

This exemption criterion puts no constraints on what types of public information qualify as exempt. The exemption does not, for example, preclude research using sensitive, stigmatizing, or embarrassing information from qualifying. Moreover, the Common Rule generally does not require researchers to obtain informed consent for exempt research. Perhaps the implications are best explained in an example. Consider the following:

Imagine Sam, an adolescent, makes a post in an online forum about their depression and struggles with drug and alcohol dependency, identifying themselves by their full name in the post. If this online forum is considered “public,” collecting and using Sam’s information for research purposes (including quoting it in publications in ways that identify Sam) may be exempt and not require informed consent from Sam. Other protections associated with IRB review, such as privacy and confidentiality safeguards, may also not be required. The same is true for any other sensitive posts made in a “public” internet space. Because of this, research using such information potentially amplifies privacy risks inherent in online and social media interactions, further calling attention to ill-advised posts and potentially leading to privacy risks and harms for internet users.

Of course, many will think individuals have some responsibility themselves to recognize the risks of public online posts. Once made, a public post already carries the risk of being widely viewed, entirely apart from any use researchers might make of it. While true, the line between public and private internet spaces is not always obvious. It is not always clear to social media users how widely available their posts may be, or what counts as a public internet space. Social media users may take the forums in which they post to be private and may be surprised to discover researchers making use of their information. Given this, the IRB’s approach to differentiating “public” from “private” internet spaces and ensuring adequate protections for posts that may justifiably be considered private takes on gravity.

How Should IRBs Approach This Matter?

The following framework identifies three different categories of online information.

1. The first category includes online information with no prerequisites at all for viewing it. For information to fall into this first category, viewing it must not require joining or logging into a platform (i.e., creating a username or password), nor for individuals to affirm they have any special features (such as suffering from a certain health condition, which is a common condition for accessing online patient support groups). Most Twitter posts would fall into this first category.
2. The second category is online information that requires joining or logging into a platform to view it but does not require the viewer to affirm any special features beyond this. An example of this type of information would be Facebook posts available to anyone with a Facebook account, but not available to individuals without a Facebook account.
3. The third and final category is the information that requires both joining or logging into a platform and affirming the user has special features. An example of this is sharing information in an online support group for patients with breast cancer that requires logging into a patient support platform (such as PatientsLikeMe) and for the individual to affirm they suffer from breast cancer.

Intuitively, the online information contained in the first category has the strongest claim to being considered “public,” while the information in the third category has the strongest claim to being considered “private.” The second category is perhaps the most challenging to evaluate. Different IRBs are likely to reach different conclusions about whether the information in these categories is “public” or “private,” but sorting online information in terms of this framework may provide a helpful first step for IRBs tasked with making these challenging determinations.

Need more information on using technology in clinical research? View our webinar Making Mobile Clinical Trials a Reality, or contact us for study-specific support.

Back to Resources