Ethics approval comes before the first participant: consent, privacy and what a committee cannot do

A team that wants to know whether its prototype works will reach for the cheapest evidence: three friends, a coffee, a few questions. Participant contact has happened, data has been collected, and because neither was approved the notes cannot be used. Approval is not a document that arrives after the interesting work; it gates the sequence. Approval first, then recruitment, then consent, then collection. This is the third of ten units, and it takes over where the client's involvement ends: the moment a person becomes a participant. The application is also where the design must first be settled. It requires the purpose, the participants, the information given, the data held and the risks. The unit argues two things. The gate is real and valuable, and it is asked to do something it cannot do. An approved protocol orders the research, but it does not make the research harmless. The live contest is whether a principles-based committee decision protects participants better than an ethics situated in the project and sustained across it.

The sequence is the design, and approval sets it

The British Psychological Society's code sets out four principles for research with human participants (British Psychological Society, 2021). The principles are respect for the autonomy, privacy and dignity of individuals and communities; scientific integrity; social responsibility; and maximising benefit while minimising harm. The code places responsibility for an adequate protocol with the researcher rather than the committee (British Psychological Society, 2021).

The form's real function is to force the design to be settled. What will participants be asked to do, for how long and with what record? What happens if they withdraw? What is stored, where and who can see it? The team that writes these answers down in week four has made the decisions deliberately; the team that does not makes them by accident when the first participant sits down.

The framework travels from medicine to computing, and stretches twice

The architecture of approval is older than HCI practice, and its shape matters because the later disputes are about how far it travels. The Belmont Report identifies three principles for research with human subjects: respect for persons, beneficence and justice. It derives three applications from them: informed consent, the assessment of risks and benefits, and the fair selection of subjects (National Commission for the Protection of Human Subjects of Biomedical and Behavioural Research, 1979).

These principles cannot always be applied so as to resolve beyond dispute particular ethical problems.

That sentence, from the report itself, is why this unit treats approval as a framework rather than a verdict. The Declaration of Helsinki supplies the institutional form: a research ethics committee, independent of the researcher and the sponsor, must approve a protocol before the research begins (World Medical Association, 2024). The association revised the declaration in October 2024 and states that version as the only official one. It moved the text from subjects to participants and called for community engagement and a considered distribution of risks, benefits and burdens.

The third principle answers a documented failure. The Tuskegee syphilis study used disadvantaged rural black men to trace the untreated course of a disease not confined to that population. It withheld demonstrably effective treatment, in order not to interrupt the project, long after that treatment became generally available (National Commission, 1979). The study's value depended on subjects going untreated, and the burden fell on a group selected for its availability. That is why the third principle yields a rule about the fair selection of subjects, and why a project recruiting whoever is easiest to reach repeats the pattern. What the case does not show is that a committee would have stopped it, since the injustice ran for decades inside institutions that already had review.

Computing did not invent a parallel code; it translated this one. The Menlo Report adapts the Belmont principles to computer and information security research and adds respect for law and public interest as a fourth core principle (Kenneally and Dittrich, 2014). The addition marks what the framework could not carry. It stretches again for a project holding personal data. The General Data Protection Regulation imposes its own requirements: a lawful basis, consent conditions, data minimisation and data-subject rights (European Parliament and Council of the European Union, 2016). The legal instrument and the ethical one are separately satisfied and neither covers the other.

An approved form is permission to begin, not a forecast of the encounter

Approval judges a proposal against principles; it cannot make the study harmless, and different committees apply the same principles differently. Bruckman makes the consequence explicit for this field. The review board is a body a researcher must persuade with a well-argued case, not a hurdle to clear (Bruckman, 2014).

The HCI literature is clear about where the mismatch falls. Munteanu and colleagues examined studies that evaluated interactive systems in difficult settings. They found formal ethics requirements hard to navigate for field research and for lab-based studies where participants need arrangements the form omits, from a sign interpreter to a telephone call instead of a web form. Waycott and colleagues collected researchers' accounts of ethical challenges in sensitive settings, and argue that reflective and empathetic approaches are needed, because the difficulties arise in the encounter rather than in the protocol (Waycott et al., 2017).

Online research is where the form runs out

The last decade has widened the gap: the material a project collects is not what the review model was built for. Vitak, Shilton and Ashktorab surveyed 263 researchers who use online data and found the disagreements are not explained by discipline, method or workplace (Vitak et al., 2016). The result is decisive: competent researchers applying the same principles reach different conclusions, so the code cannot be self-applying.

Shilton names the hardest version of the problem. Participatory personal data is both identifying of an individual and accessible by that individual, and it raises privacy, consent and ownership questions (Shilton, 2012). A project that logs its own users' location or text holds exactly this material, and ownership is not a question the ethics form answers.

There is a legal layer on top. Fiesler, Beard and Keegan analysed the terms of service of more than one hundred social media sites. They found prohibitions on data collection common but ambiguous, inconsistent and lacking context. They argue that ethical decision-making should extend beyond the terms of service to the research context (Fiesler et al., 2020). A method can therefore breach a platform's terms independently of any ethics review.

Contested question: does a principles-based committee protect participants better than a situated, ongoing ethics of care?

The first position holds that the committee model protects participants because it makes consent and independent scrutiny routine. The codes reduce the same field to a small set of principles and applications. The review architecture makes them operational before any participant is contacted (National Commission for the Protection of Human Subjects of Biomedical and Behavioural Research, 1979; British Psychological Society, 2021). The claim is not that the committee prevents every harm, but that it makes the sequence orderly and the scrutiny independent.

The second position holds that a one-off approval is the wrong instrument for the research being done, and that protection comes from an ethics situated in the setting. Its evidence is the pattern above. Formal requirements are hard to navigate in the field (Munteanu et al., 2015). Difficulties surface during the encounter rather than before it (Waycott et al., 2017). Accountability is constructed through debate and reflection rather than conferred by approval (Frauenberger et al., 2015). Brown and colleagues put the case at its sharpest. They argue that regulation has unintended consequences and that procedure does not resolve moral conflicts, and they propose an alternative grounded in the sensitivities of those studied (Brown et al., 2016).

What would settle it is a study that holds the project constant and varies only the review regime. It would measure participant protection and experience with instruments independent of the committee. Nobody in this literature runs that study. The evidence on both sides is reasoning from cases and reports of difficulty, which is why this unit reserves judgement rather than declaring a winner.

Both sides rest on the same kind of evidence: documented cases and reports of difficulty. The committee case rests on codes written after a documented failure (National Commission, 1979); the situated case on accounts from field and online research (Munteanu et al., 2015; Waycott et al., 2017). While the question is open, keep approval as the gate and carry the ethics past it: a data map, a stated withdrawal route, one named person to raise a concern with. The strongest objection is that this doubles work a small team barely does, and that the situated case argues from the limits of procedure, not from evidence that it protects people better.

Where the argument is heading

The direction of travel is towards ethics that is ongoing and contextual rather than settled once. Nebeker, Torous and Bartlett Ellis survey a landscape in which apps and sensors collect granular personal data continuously, and recommend that ethics be actionable during the study (Nebeker et al., 2019). Brown and colleagues call for support of low-risk ethical experimentation (Brown et al., 2016). Fiesler and colleagues ask that decisions about data collection weigh the source and the research, not the terms of service alone (Fiesler et al., 2020). For a student team the reading is stable: approval is the gate, not the whole of the ethics.

The sources this unit rests on

• World Medical Association (2024). WMA Declaration of Helsinki: ethical principles for medical research involving human participants. https://www.wma.net/policies-post/wma-declaration-of-helsinki/ Requires approval of a protocol by a research ethics committee independent of the researcher and the sponsor before research begins, and voluntary, informed participation. The 2024 revision, the only official version, moves the text from subjects to participants and calls for community engagement. It is the originating statement of the review architecture.
• National Commission for the Protection of Human Subjects of Biomedical and Behavioural Research (1979). The Belmont Report. US Department of Health, Education, and Welfare. https://www.hhs.gov/ohrp/regulations-and-policy/belmont-report/read-the-belmont-report/index.html Identifies three principles, respect for persons, beneficence and justice, and derives informed consent, risk-benefit assessment and fair selection of subjects. It concedes they cannot always settle a particular case, which is why the unit treats approval as a framework.
• Kenneally, E. E. and Dittrich, D. (2014). The Menlo Report. US Department of Homeland Security. doi:10.2139/ssrn.2445102 Adapts the Belmont principles to computer and information security research and adds respect for law and public interest as a fourth principle. It shows that computing had to extend the framework before it fitted.
• British Psychological Society (2021). Code of human research ethics. British Psychological Society. https://www.bps.org.uk/guideline/code-human-research-ethics Sets out four principles for research with human participants, respect for autonomy, privacy and dignity, scientific integrity, social responsibility, and maximising benefit while minimising harm. It places responsibility for an adequate protocol with the researcher, not the committee.
• European Parliament and Council of the European Union (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). https://eur-lex.europa.eu/eli/reg/2016/679/oj Sets the legal requirements for processing personal data, including a lawful basis, consent conditions and data-subject rights. It is the second gate, legal rather than ethical, that the form does not cover.
• Bruckman, A. (2014). Research ethics and HCI. In Olson, J. and Kellogg, W. (eds) Ways of Knowing in HCI. Springer. doi:10.1007/978-1-4939-0378-8_18 Reviews the ethical challenges of HCI research and treats the review board as a body to be persuaded with a well-argued case rather than a hurdle to clear. Its contribution is the researcher's responsibility where the code runs out.
• Munteanu, C., Molyneaux, H., Moncur, W., Romero, M., O'Donnell, S. and Vines, J. (2015). Situational ethics. Proceedings of CHI. doi:10.1145/2702123.2702481 Finds formal ethics requirements hard to navigate for field research and for studies with vulnerable users, and calls for refined guidance. It is the primary evidence that one-off approval fits field research poorly.
• Waycott, J., Munteanu, C., Davis, H., Thieme, A., Branham, S., Moncur, W., McNaney, R. and Vines, J. (2017). Ethical encounters in HCI. CHI Extended Abstracts. doi:10.1145/3027063.3027089 Reports a workshop collecting researchers' accounts of ethical challenges in sensitive settings, and argues reflective and empathetic approaches are needed. It records problems met after approval rather than before it.
• Frauenberger, C., Good, J., Fitzpatrick, G. and Iversen, O. S. (2015). In pursuit of rigour and accountability in participatory design. International Journal of Human-Computer Studies. doi:10.1016/j.ijhcs.2014.09.004 Argues that rigour and accountability are delivered through debate and reflection, and proposes four lenses, epistemology, values, stakeholders and outcomes. It supports the claim that accountability is constructed rather than conferred by approval.
• Brown, B., Weilenmann, A., McMillan, D. and Lampinen, A. (2016). Five provocations for ethical HCI research. Proceedings of CHI. doi:10.1145/2858036.2858313 Sets out five provocations, including informed consent, the researcher-participant power differential and the role of review boards, and argues regulation has unintended consequences. It is the clearest statement of the against side of the thesis.
• Vitak, J., Shilton, K. and Ashktorab, Z. (2016). Beyond the Belmont principles. CSCW. doi:10.1145/2818048.2820078 Surveys 263 researchers who use online data and finds the disagreements are not explained by discipline, method or workplace. Competent researchers applying the same principles reach different conclusions.
• Shilton, K. (2012). Participatory personal data. Journal of the American Society for Information Science and Technology. doi:10.1002/asi.22655 Characterises participatory personal data, data that is both identifying of an individual and accessible by that individual, and sets out the privacy, consent and ownership questions it raises. It names the hardest data a student project is likely to hold.
• Fiesler, C., Beard, N. and Keegan, B. C. (2020). No robots, spiders, or scrapers. Proceedings of the International AAAI Conference on Web and Social Media. https://ojs.aaai.org/index.php/ICWSM/article/view/7290 Analyses the terms of service of more than one hundred social media sites and finds such prohibitions common but ambiguous, inconsistent and lacking context. It argues decision-making should extend beyond the terms of service to the research context.
• Nebeker, C., Torous, J. and Bartlett Ellis, R. J. (2019). Building the case for actionable ethics in digital health research supported by artificial intelligence. BMC Medicine. doi:10.1186/s12916-019-1377-7 Surveys a landscape in which apps and sensors collect granular personal data continuously and recommends that ethics be actionable during the study. It is the clearest statement of where the field is heading.