03 · What You Need to Know
Understanding Responsibility for Confidentiality Failures in Outsourced Research
What Counts as Mishandling Confidential Participant Information?
Mishandling occurs when participant information is accessed, used, disclosed, altered, retained, or transferred in a manner inconsistent with applicable authorization or requirements.
Examples may include sending transcripts to the wrong recipient, storing identifiable recordings in an unauthorized service, sharing participant details with unapproved subcontractors, or retaining files beyond an agreed deletion period.
Other incidents may involve stolen devices, compromised credentials, misconfigured storage permissions, or unauthorized secondary use of research data.
These events differ in severity and consequences. An accidentally misaddressed email that is promptly contained may create different risks from a publicly accessible repository containing identifiable interviews.
The appropriate response should reflect the nature of the information, the exposure, the likelihood of misuse, and the applicable obligations.
Why Is Research Participant Confidentiality Different From Ordinary Commercial Confidentiality?
Research confidentiality may protect information entrusted to researchers under specific ethical representations and consent arrangements.
Participants may disclose personal experiences, institutional conflicts, health information, or other sensitive matters because they understand that the research team will restrict access and use the information for defined purposes.
A commercial confidentiality agreement can help implement those obligations, but it does not necessarily reproduce every condition established through research ethics review.
For example, participants may have consented to analysis by an approved research team without authorizing unrestricted processing by external vendors.
Researchers should therefore examine whether the proposed outsourcing is compatible with the consent materials, ethics approval, and relevant data-protection requirements before information is transferred.
How Are Responsibilities Distributed?
| Party |
Potential responsibility |
Important qualification |
| Principal investigator |
Ensure appropriate research governance, authorized data handling, and escalation of identified concerns. |
Individual liability depends on actual duties, conduct, and applicable standards. |
| Research institution |
Establish governance, oversight, security requirements, and incident-response procedures. |
Legal responsibilities depend on its role and applicable law. |
| Research contractor |
Process information according to authorized instructions, contracts, and applicable legal duties. |
Obligations depend on the services and processing relationship. |
| Contractor personnel |
Follow authorized procedures and protect information accessed through their work. |
Employment and individual legal responsibilities vary. |
| Ethics or privacy oversight authorities |
Review or direct responses within their institutional or regulatory jurisdiction. |
Not every incident falls under the same reporting mechanism. |
These responsibilities may overlap. Identifying the person who made the immediate mistake does not necessarily resolve whether appropriate safeguards existed or whether the research institution fulfilled its own obligations.
Does Signing a Confidentiality Agreement Remove the Researcher's Responsibility?
No. A confidentiality agreement may establish enforceable duties and remedies, but it does not automatically eliminate independent research ethics or data-protection obligations.
For example, a researcher may obtain a contractor's promise not to disclose recordings while failing to determine whether external processing was permitted under the approved research protocol.
Conversely, a researcher who followed institutional procedures, selected an appropriately vetted provider, and implemented required safeguards is not automatically personally culpable because an employee subsequently violated those controls.
Contracts are one element of responsible outsourcing, not a substitute for governance and oversight.
The adequacy of the arrangement should be assessed according to what was reasonably required before the incident and how the parties responded afterward.
What Is the Difference Between a Personal Information Controller and a Processor?
In jurisdictions using controller-processor distinctions, the controller generally determines the purposes and means of processing personal information, while a processor handles information on the controller's behalf.
Under the Philippine Data Privacy Act of 2012, the concepts of personal information controller and personal information processor are relevant to determining applicable obligations.
A university may act as a controller for particular research processing activities, while an external transcription service may act as a processor. However, the actual classification depends on the parties' functions rather than their contractual labels alone.
If a provider independently determines additional purposes for using participant information, the legal analysis may become more complicated.
Researchers should consult their institutional data protection officer or qualified legal adviser when determining the parties' roles.
What Should Researchers Verify Before Transferring Participant Data?
Before engaging a contractor, researchers should determine whether the transfer is authorized and necessary.
Relevant considerations include the provider's security arrangements, permitted personnel access, storage location, subcontracting practices, retention period, incident reporting, and deletion procedures.
The research team should also examine whether identifiable information can be removed or reduced before transfer.
For example, a transcription provider may not need participants' names or institutional identification numbers to produce accurate transcripts.
However, removing direct identifiers may not eliminate identifiability when recordings contain recognizable voices or distinctive personal experiences.
Data minimization should therefore be accompanied by an assessment of residual disclosure risks.
Does Removing Names Make Interview Recordings Anonymous?
No. Audio recordings may contain recognizable voices, and transcripts may include contextual details that allow individuals to be identified.
A participant might describe a distinctive administrative role, a particular workplace incident, or a combination of characteristics that is recognizable to colleagues.
Removing names can reduce identifiability but does not necessarily produce anonymous data.
Researchers should distinguish anonymization from pseudonymization and other forms of de-identification.
The distinction matters when deciding whether external processing, disclosure, or retention is permitted.
Confidentiality safeguards should reflect the realistic possibility of identification rather than assume that replacing names with participant codes eliminates all risk.
What Should Happen Immediately After a Suspected Breach?
The first response should follow the institution's authorized incident-response procedures.
Appropriate actions may include notifying the institutional data protection or information security team, securing exposed systems, restricting unauthorized access, and preserving relevant logs or communications.
Researchers should avoid independently deleting evidence or attempting unauthorized access to the contractor's systems.
The institution and contractor should establish what information was affected, who may have accessed it, whether the exposure remains active, and what containment measures are available.
Where there is a credible immediate risk to participants, protective action should not wait for the completion of an unrelated research misconduct investigation.
Watch Out
Do not delay reporting a suspected confidentiality incident merely because the contractor promises to resolve it privately. Institutional and legal reporting deadlines may depend on when relevant parties became aware of the incident, and unauthorized attempts to conceal or erase evidence can create additional problems.
Must Every Confidentiality Incident Be Reported to a Privacy Regulator?
Not necessarily. Mandatory notification depends on the applicable legal framework, the information involved, the nature of the incident, and the relevant notification threshold.
Under Philippine data protection rules, certain personal data breaches require notification to the National Privacy Commission and affected data subjects when the applicable conditions are satisfied.
The Data Privacy Act and its implementing rules should be read alongside relevant National Privacy Commission circulars and current guidance.
Researchers should not assume that every accidental disclosure automatically triggers the same external notification obligation.
Equally, they should not conclude that a breach is exempt merely because the contractor caused it.
Determinations concerning reportability should be made promptly through the responsible institutional officials using the applicable rules.
Should Participants Be Informed?
Participant notification may be required by law, ethics approval, institutional policy, or the circumstances of the incident.
The decision should consider what information was exposed, the risks to participants, and whether notification can help them take protective action.
For example, unauthorized disclosure of identifiable interviews about workplace discrimination may create risks of professional or social harm.
Notification should be accurate and should not overstate or minimize what is known.
Where the investigation is ongoing, the institution may need to explain uncertainty while providing relevant protective information.
The research team should coordinate communication through authorized channels rather than independently contacting participants in a manner that could compromise evidence or conflict with legal obligations.
What if the Contractor Used an Unauthorized AI Service?
A contractor may upload recordings, transcripts, or research documents to an AI-enabled service for transcription, translation, summarization, or coding.
Whether this is permissible depends on the approved processing arrangement, the service's data practices, and applicable institutional and legal requirements.
Unauthorized use may expose information to additional systems or providers that were not considered during the original ethics and privacy assessment.
Researchers should determine what material was transferred, which service received it, what retention or reuse conditions apply, and whether deletion or containment is possible.
The use of AI does not automatically establish that information was publicly disclosed or used for model training. Those questions require examination of the particular service and processing terms.
The concern is unauthorized or inadequately protected processing, not merely the presence of AI technology.
What if the Contractor's Employee Caused the Incident?
An employee's conduct may be relevant to individual and organizational responsibility, but the existence of an employee error does not automatically absolve the contractor.
The organization may have duties concerning staff training, access controls, supervision, and security procedures.
For example, if every employee could download all participant recordings without a legitimate operational need, the incident may reveal a broader access-control weakness.
Conversely, an employee may circumvent otherwise appropriate safeguards.
The assessment should distinguish the immediate cause from the adequacy of the surrounding controls.
Researchers should avoid attributing legal responsibility before the relevant facts and governing obligations have been examined.
Can the Research Continue After a Confidentiality Breach?
Potentially. Continuation depends on the nature of the breach, participant risks, ethics approval, and the institution's assessment.
Some incidents may be contained without compromising the scientific validity of the collected observations.
Other incidents may undermine the conditions under which participants consented or create continuing risks that require changes to data handling or study procedures.
The institution may need to suspend particular processing activities, change providers, amend the protocol, or obtain further ethics guidance.
Researchers should distinguish participant protection from the question of whether the data remain analytically usable.
A dataset may be scientifically valid while its collection or processing raises serious ethical concerns.
Does a Privacy Breach Automatically Constitute Research Misconduct?
No. A confidentiality violation and a formal research misconduct finding are distinct matters.
Under the U.S. Public Health Service framework, research misconduct concerns fabrication, falsification, or plagiarism within the regulation's scope.
A privacy breach may violate ethics approval, institutional policy, contractual obligations, or data-protection law without necessarily satisfying that definition.
However, deliberate concealment, falsification of compliance records, or misrepresentation of research procedures may raise additional concerns under applicable frameworks.
Institutions should refer each issue to the appropriate authority rather than assume that every research-integrity problem belongs in the same investigative process.
What Should Researchers Document After the Incident?
Documentation should establish a reliable chronology of the incident and the response.
Relevant information may include when the issue was discovered, what information was affected, who was notified, what containment measures were taken, and which decisions were made by authorized officials.
Researchers should preserve relevant communications, provider explanations, incident reports, and corrective-action records according to institutional requirements.
Documentation should distinguish confirmed facts from unresolved possibilities.
For example, evidence that a file was stored in an unauthorized cloud account does not necessarily establish that an external person downloaded it.
Accurate records support regulatory assessment, institutional accountability, and future improvements.
How Can Future Confidentiality Failures Be Prevented?
Risk reduction begins before outsourcing. Researchers should select appropriate providers, define permitted processing, minimize unnecessary information transfers, and establish security and incident-reporting requirements.
Technical measures may include encryption, access restrictions, secure transfer, and appropriate logging, depending on the data and systems.
Contracts should address subcontracting, retention, deletion, and unauthorized processing.
Researchers should also verify that the provider's actual workflow matches the agreed procedures rather than relying exclusively on general assurances.
The ethical considerations associated with outsourcing qualitative transcription and coding are particularly relevant when recordings contain identifiable participant information.
No arrangement can guarantee that incidents will never occur, but proportionate safeguards can reduce foreseeable risks and support effective response.
