03 · What You Need to Know
“Ownership” Is Usually Too Crude for Research Data Governance
Control Has Several Different Dimensions
When researchers ask who owns a dataset or specimen collection, they may actually be asking several different questions. Who physically possesses it? Who decides who can access it? Who can approve secondary studies? Who is responsible for security? Who can transfer it abroad? Who can publish analyses? Who decides whether samples are destroyed?
Those powers do not necessarily belong to the same party.
Custody
Physical or technical possession and responsibility for storing research data or biological materials.
Governance
The rules and decision-making arrangements determining access, use, sharing, transfer, secondary research, retention, and other actions involving the materials.
An institution can hold custody without having unrestricted authority to use the materials however it wishes.
Participant Consent Defines Important Boundaries
Participants should be told what will happen to identifiable or potentially identifiable data and biological materials to the extent required by the applicable ethics framework. This can include storage, future use, sharing, recontact, commercial use where relevant, and whether materials may be transferred to other institutions or countries.
CIOMS provides detailed guidance on the collection, storage, and use of biological materials and health-related data. Its guidelines recognize several consent approaches for future use, including broad informed consent under appropriate governance arrangements, while requiring ethical safeguards for storage and secondary research.
Consent therefore matters greatly, but it does not by itself create a complete governance system. A participant might authorize broad future research while institutions still need procedures determining which proposed uses are scientifically and ethically acceptable.
Broad Consent Does Not Mean Unrestricted Use
Researchers sometimes interpret broad consent as permission to do virtually anything with stored materials. That is too broad an interpretation.
CIOMS describes broad informed consent as consent for a range of future research uses subject to specified governance. It is not equivalent to blanket permission for unlimited research unrelated to the terms under which the materials were collected.
Future uses may also require additional ethics review, depending on identifiability, consent, the nature of the proposed research, applicable law, and institutional policy.
Physical Possession Does Not Create Ethical Ownership
Samples may be shipped to a better-equipped laboratory because that institution has specialized technology. Data may be stored on a secure server in another country because the lead institution has greater technical capacity.
Neither transfer automatically settles governance.
If local researchers must later ask a foreign institution for permission to analyze data they helped generate, or if samples can be reused without consultation with the institutions and communities from which they came, the storage arrangement may have quietly become a power arrangement.
This is one reason data and sample governance is central to determining whether an international partnership is equitable across high-resource and low-resource settings.
International Transfer Adds Another Layer of Requirements
Moving data or biological materials across borders can trigger legal, regulatory, contractual, privacy, biosafety, export, import, or ethics requirements that do not arise when materials remain within one institution.
The specific rules vary considerably by jurisdiction and by the type of material involved. Researchers should therefore verify applicable requirements before transfer rather than assuming that participant consent alone authorizes international movement.
Material transfer agreements, data transfer agreements, data use agreements, or similar instruments may specify what the receiving institution can do with transferred materials. The appropriate agreement depends on the project and applicable legal system.
International Ethics Guidance Emphasizes Governance of Stored Materials
CIOMS states that institutions storing biological materials and related data should have governance systems covering matters such as which legal entity has custodianship, how authorization from donors is obtained, how access is controlled, how confidentiality is maintained, how future use is determined, and what happens when the repository closes.
For health-related data, CIOMS similarly requires governance structures for collection, storage, and use and emphasizes safeguards proportionate to the sensitivity of the information and the risks of disclosure.
Good governance therefore requires more than secure storage. It requires legitimate decision-making.
De-Identification Reduces Some Risks but Does Not End Governance
Removing direct identifiers can reduce privacy risks, but “de-identified” is not a universal ethical off-switch. Re-identification risks depend on the data, available technologies, linked datasets, population size, and context.
Genomic data are an obvious example because biological information can be intrinsically identifying and can also reveal information relevant to biological relatives.
Even data that pose little individual identification risk can create collective harms when findings concern a small or identifiable population.
Communities May Have Legitimate Interests Beyond Individual Consent
Research data and samples can sometimes carry collective significance. Genomic information, Indigenous knowledge, culturally sensitive materials, environmental samples, or information identifying a small community may implicate interests beyond those of the individual donor.
The CARE Principles for Indigenous Data Governance were developed to complement data principles focused primarily on technical openness and reuse. CARE emphasizes Collective Benefit, Authority to Control, Responsibility, and Ethics, reflecting the importance of Indigenous peoples’ rights and interests in data about their peoples, territories, resources, and knowledge.
These principles do not mean that every dataset collected from any community becomes collectively owned. They illustrate why researchers should determine whether legitimate collective governance applies rather than assuming all research materials are simply institutional assets.
Open Science Does Not Mean Open Everything
Data sharing can improve reproducibility, enable new research, and increase the value of datasets. Yet open science obligations coexist with consent, privacy, confidentiality, Indigenous governance, contractual restrictions, intellectual property, and legitimate limits on secondary use.
The FAIR Principles aim to make data Findable, Accessible, Interoperable, and Reusable. Importantly, “Accessible” does not necessarily mean publicly downloadable without conditions. Access can be controlled through authentication and authorization where appropriate.
The CARE Principles were developed partly because technical data-sharing principles alone may not address power, collective rights, or equitable benefit.
Secondary Use Should Be Planned Before the First Dataset Exists
International collaborations often generate datasets valuable for questions that were not part of the original protocol. If governance has not been agreed in advance, disputes may arise over who can propose secondary studies, who approves them, whether local researchers must be included, and how authorship or benefit will be handled.
A governance agreement can establish a transparent process without requiring every future analysis to be predicted in advance.
Sample Destruction Is Not Always Simple
Participants may ask whether biological materials can later be withdrawn or destroyed. Researchers should explain accurately what is possible under the applicable consent model and repository procedures.
Withdrawal may not be able to undo research already performed, results already generated, data already included in analyses, or materials already distributed in ways permitted by the consent and governance framework.
Researchers should avoid promising complete future erasure if the research infrastructure cannot actually provide it.
Commercial Value Should Not Appear as a Surprise
Data and biological materials can contribute to commercially valuable discoveries. Applicable consent and ethics requirements vary, but researchers should not obscure foreseeable commercial uses or imply that participants will personally share in profits unless such an arrangement genuinely exists.
CIOMS includes commercial use among issues that may need to be addressed when seeking broad consent for stored biological materials and data.
Watch Out
Do not wait until valuable data or samples have already been transferred to negotiate who controls them. Once one institution possesses the only usable copy, specialized infrastructure, or legal custody, supposedly equal negotiation can become rather theoretical.
Governance Should Outlive the Original Principal Investigator
Datasets and repositories can survive grants, research teams, and careers. Governance should therefore be institutional enough to answer what happens when investigators leave, collaborations dissolve, funding ends, repositories close, or future researchers request access.
A personal understanding between two principal investigators is not an adequate long-term governance system for materials expected to remain scientifically useful for years.
