Attachment A - IRB Authority Use of Data Collected and Developed


A long-standing debate in the field of research ethics is whether the results of research that is conducted in an unethical manner should be used to contribute to generalizable knowledge, and if so, which entities involved in the conduct and publication of research should have a role in making that decision.  Usually the proposed method of restricting the contribution to generalizable knowledge is through restrictions on use of the data or human biospecimens, such as publication or other uses.  A recent article by Barnes et al discusses this issue at length, and serves as a useful background reference for this recommendation.   
The most prominent and public discussion of this issue has concerned the use of data of obtained from unethical research conducted by the Nazis during World War II, such as the hypothermia studies. However, it is very rare for research today to be conducted in such a blatantly unethical matter, and these cases does not necessarily provide a useful corollary for considering the appropriate ethical approach in less severe cases of research ethics violations. 
There are several types of situations that might warrant restrictions on the use of data collected and developed in the conduct of research.  Examples include research that is done without IRB review, research that is done without obtaining the consent of the subjects, research that involves undue influence or coercion to force subjects to participate, research that results in serious harm to subjects due to failure to follow research regulations and requirements, and research in which the public use and release of the data may result in harm to the subjects.  In each of these situations, the facts will be important to ascertaining the materiality of the ethical and regulatory breaches and the decision whether to restrict the use of the data.  

Types of Limitations on Data and Biospecimen Use

Limitations on data use can take several forms.  It can be a full prohibition on all uses of the data, or a probation on a certain use, such as publication or submission to a drug regulatory agency for consideration of approval of a medical product.  The limitation could also involve restrictions on the reuse of the data or human biospecimens collected in the research. Finally, the limitation could be the requirement to include a statement about the ethicality of the research in a publication or with another limitation.  This last approach is put forth as one possible approach in the AMA Code of Medical Ethics. 

Ethical Arguments

There are ethical arguments both for and against restrictions on the use of data collected from unethical research, and the relative weight of these arguments will be dependent on the facts of the case and the nature and magnitude of the ethical violations in the research.   The most common framework for assessing the ethicality of research in the United States are the Belmont principles of Respect for Persons, Beneficence and Justice.  These principles provide a useful tool for assessing research, although at times they can lead to conflicting ethical recommendations.  Most often a claim that research is unethical can be tied to a violation of one of the Belmont principles.  These principles have been largely captured in the IRB regulations (The Common Rule) and therefore a violation of a Belmont principle will usually indicate a regulatory violation as well, as discussed below.  
There are several arguments in favor of restricting the use of data from research that is conducted unethically, particularly when the ethical violations are not minor.  First, it provides a punishment to the investigators and others involved in the conduct of the research by not allowing them to enjoy the personal benefits of publishing research results, such as career promotion, recognition, and financial gain.  Second, it provides a disincentive to the researcher, and to others in the future, to conduct research in an unethical manner, as the use of the results may be restricted.  Finally, it shows respect for the research subjects who were involved in the unethical research, particularly if they were put at risk or injured due to the unethical conduct of the research.
There are also several arguments against restricting the use of data from research that is conducted unethically.  First, it limits the contribution to generalize knowledgeable, which may help others in society.  Second, there are limited amounts of funding and resources available for the conduct of research and restricting the use of the data wastes those resources, and also may lead to a second researcher performing similar research again in the future in order recreate the data.  Finally, it can be argued that it shows respect to the subjects who were involved in the research to allow the data to contribute to generalizable knowledge by providing a mechanism for some benefit to come from their involvement in the research, particularly if the subjects were harmed by the research.  This argument has been used regarding the subjects who were killed or injured in the Nazi research during WW II.  
In determining whether research was conducted unethically, and in determining the appropriate response against the researchers, there must be a careful consideration of the facts of the case and the nature and magnitude of the ethical violations in the research.  The use of research data should only be restricted when there are substantial violations of the Belmont principles or other ethical standards.  Minor infringements of ethical principles should not generally lead to restrictions on data use absent unique compelling facts.  As noted below, regulatory findings such as continuing or serious non-compliance can serve as an additional standard in determining whether research data should be restricted.


The Common Rule does not directly address the issue restricting research data use.  However, the FDA human subject protection regulation at 21 CFR 56103(b) does.  In this regulation, it is the FDA that is the acting party and would make the decision to restrict the use of the data. 
(b) Except as provided in §§ 56.104 and 56.105, the Food and Drug Administration may decide not to consider in support of an application for a research or marketing permit any data or information that has been derived from a clinical investigation that has not been approved by, and that was not subject to initial and continuing review by, an IRB meeting the requirements of this part. The determination that a clinical investigation may not be considered in support of an application for a research or marketing permit does not, however, relieve the applicant for such a permit of any obligation under any other applicable regulations to submit the results of the investigation to the Food and Drug Administration.
The SACHRP membership does not know of any cases in which the FDA has used this authority.  However, FDA has more direct and readily useable mechanisms in the drug and device regulations at 21 CFR 312, 314, 812 and 814, respectively, and in addition has other enforcement mechanisms such as Warning Letters.
Some institutions have written policies giving the institution or the institution’s IRB the authority to restrict the use of research data.  The article by Barnes et al provides a summary of the policies from the top twenty recipients of NIH funding in 2018.   Three of those institutions explicitly give the IRB the authority to restrict the use of research data, four provide that the designated institutional official or other institutional authorities have such authority, and the remaining thirteen have general statements that parties might take corrective actions as appropriate, but do not specifically address data restrictions. 
Neither the Common Rule nor the FDA regulations specifically provide institutions or IRBs the regulatory authority to restrict the use of research data.  The Common Rule at section .103 requires the institution to make certain assurances to the funding agency, including compliance with the requirements of the Common Rule.  The Common Rule and the FDA regulations give IRBs the authority to “ to approve, require modifications in (to secure approval), or disapprove” research activities,  and provide IRBs with the authority to make findings of serious or continuing non-compliance, findings of an unanticipated problem involving risks to subjects or others, and to suspend or terminate research.   Therefore, a decision by an institution or IRB to restrict the use of research data is not relying directly on the IRB regulations for authority. However, because the IRBs have the authority to take the more profound actions of suspending or terminating research activities, it is logical to conclude that IRBs and institutions should also have the authority to restrict the use of research data as a means of protecting the rights and welfare of research subjects, particularly after the research has ended, because the use of the data is a research activity.  In addition, there may be other applicable authority, such as institutional policy, faculty guidelines, Responsible Conduct of Research regulations or policy, or local law.  In all cases, there should be attention to appropriate due process.  

Guidance Documents

There are some references to restricting data obtained from unethical research in guidance documents.  Clause 36 of the Declaration of Helsinki states that “Reports of research not in accordance with the principles of this Declaration should not be accepted for publication.”
The American Medical Association addresses the issue in Ethics Opinion 7.2.2, “Release of Data from Unethical Experiments.”  It states that data obtained from cruel and inhumane experiments should virtually never be published, but describes rare instances where publication might be appropriate if it is the only source of the data.  If this is done, there should be disclosure of the facts and an ethical discussion.  An example of this approach can be found in a 2003 volume of The Annals of Thoracic Surgery.   The case involved a prospective randomized investigation of the role of postoperative radiotherapy in the treatment of squamous cell esophageal cancer, without consent.  The article provides an argument for publication of these results despite the failure of consent.

Non-Governmental Bodies That Can Make Determinations to Restrict the Use of Research Data 

IRBs and Institutions

As noted above, at large research institutions the authority to restrict the use of research data may be entrusted to IRBs or to the institution.  Larger research institutions generally have mature Human Research Protection Programs (HRPP) with several components, such as Human Resources departments, Responsible Conduct of Research Committees, and Faculty Policies.  In these settings, regardless of whether the IRB is located at the institution or is external, several of these HRPP components can be involved in the analysis of allegations of non-compliance with the regulations and can draw on the authority from these components as appropriate.  

As the size of the institution decreases, there generally will be fewer components in the HRPP.  At small research sites, such as clinics and single practitioner offices, the components of an HRPP are usually limited, and the IRB will almost certainly be external.  In this setting, there is more likelihood that the IRB will be the only party that is available to determine whether to restrict the use of research data.
Clinical Sponsors

Drug and device companies can decide to restrict the use of research data if they believe there are problems with the research.  For instance, if there is evidence of fraud at a site, the sponsor may decide to remove that site’s data from the data set.  Such changes in data must be disclosed to FDA and other regulatory bodies.

In recent years, publishers and, specifically,  medical journal editors, have taken on a significant role as gatekeepers by establishing requirements, standards, and expectations with regard to disclosure of financial interests, transparency in clinical trial registration,  research misconduct, and of course, IRB and research ethics committee review.  Journal editors can have a role in determining whether to publish research that is conducted unethically and in violation of regulatory requirements.  Many journals have policies in place to address this issue, as noted above in the discussion of the AMA guidance.


  1. OHRP and FDA should issue guidance on the topic of institutions and IRBs restricting the use of scientific knowledge that is collected in violation of the Common Rule and equivalent FDA regulations.  The guidance should explain that while these regulations do not explicitly provide such authority, the authority is inherent in the IRB’s authority to suspend or terminate research.   Institutions and IRBs may establish such policies based on this authority, or on other institutional policies.
  2. OHRP and FDA may wish to include criteria for considering these cases.  For instance, a possible set of criteria would be that data should not be published or otherwise used when : (a) when consent was not obtained in compliance with the federal regulations or IRB authorization to allow the researchers to have gathered and to use those data, (b) when using or publishing the data would likely result in direct harm to subjects, or (c) when the failure of researchers to adhere to regulatory and ethical standards has impaired the data's integrity
  3. Institutions and IRBs should determine in advance if they plan to maintain the authority to restrict the use of scientific knowledge that is collected from research that violates the Belmont principles or that Human Subject Protection regulations in the Common Rule and FDA regulations.  If they do so, the policy should be written and publicly available.  Ideally, the policy will address different types of restrictions on the use of data, such as publication, and prohibitions on further use of the data or human biospecimens.
  4. When institutions and IRBs consider the use of this policy, they should carefully weigh the nature and magnitude of the ethical violations and regulatory non-compliance, and balance the use of the policy to the facts of the case and other circumstances such as the PI’s record.   These actions should be taken in consultation with other stakeholders as appropriate.
Content created by Office for Human Research Protections (OHRP)
Content last reviewed