I would be interested to hear what your IRB would say about your example, taking notes about people walking in the park. If you were compiling detailed information about them (such as gender, ethnicity, hometown state, political views, sexual interests, college major, relational data, and interests), and then publicizing that specific data to the entire world, I wouldn’t be surprised if consent would be required before widespread publication of the raw data.

My point is, your research is not simply taking notes of observable information about random people in the park on a random day and time. This dataset represents detailed and non-obvious personal information intentionally posted to a social networking site for a specific purpose, something the subjects likely did with the particular context and informational norms of that space in mind. While much of the information might in fact be publicly available, we should consider whether the subjects actually intended for it to be collected, archived, and distributed in such a way that other people could sort it, aggregate it, mine it, and perhaps de-identify it.

And, as I noted above, if the research team did in fact use RAs from the same school as the subjects to pull the profile data, it seems quite likely that some profiles that were meant to be seen by only people within that network have been included in the public release. If true, that should be seen as an obvious violation of their expressed privacy interests.

Do you have any sense as to whether that has occurred? Have you tried pulling the same profiles from a FB account that is not a member of that network? I would be curious as to the results.

If anyone would do any type of research using my data, I’d feel really offended (notwithstanding the fact that I still know FB owns the data; now, do I believe it is OK? No, in fact, I know something, but I believe something else – FB’s statement of ownership is not legitimate – and I guess many of those students feel the same).

I think any research involving human beings of some sort (and this includes the poorly made state-backed mass surveys) SHOULD ask for individual consent (I realize though it is hard to achieve, but the researchers could have mass emailed all participants and given them a chance to withdraw from the research project). Data obtained in this project is important, but unethical in my view. I’m disappointed that such a big institution showed such disdain for regular users.

A quick question for Jason: did you consult with privacy experts (either at Berkman or elsewhere) when deciding how to parse and release the data? Just curious.

I recognize the danger, but I’m afraid I’m with Jason on this. The data is already there, this is merely (!) the collection of that data. Or to put it another way, AOL users presumed that no one was watching, but this is very different from Facebook users who are intending to share with someone (if not the researchers).

Is there a privacy concern? Of course! But I think the measures in place are strong enough to introduce a kind of “friction” (again something that didn’t exist in the openly downloaded and reposted data set from AOL) that provides a barrier to broad revelations, and this friction mitigates the problem. I presume mitigation is what you are after.

If Sarah Palin is in the data set, someone will find her and make it open, but at some level, it would be easier for someone to do this with the original data (i.e., Facebook) than go through the hassle of self-identifying to this group.

All that said, I’m a little surprised this made it through IRB. Consent (via, for example, an opt-in Facebook app), would have alleviated a lot of these problems. Of course, network data sucks when you have missing nodes, and not everyone would opt-in. But then, isn’t that the point: if they wouldn’t opt in, maybe we shouldn’t be including them…

Jason: Give up on anonymizing the college. I’m with Michael here: cat may not be entirely out of the bag, but he is far enough out that he won’t be rebagged. And while taste data may be used to identify individuals, it can almost certainly be used to infer differences in the aggregate (e.g., sports team favorites, favorite bars, music, etc., are all fairly localized).