How An Ethics Board Can Help Your Company
Data concerning aspects of our lives, including our health, is regularly collected by companies and healthcare systems. Since lax data protection policies can severely impact people, protecting that data is important for both ethical and business reasons: it will promote the safety and well-being of customers, and it will ensure that the company maintains trust with its users. However, identifying and addressing all of the relevant ethical issues can be daunting. One strategy is to adopt a research ethics board (REB) model. (REBs are also called institutional review boards, or IRBs.)
A research ethics board is a common institutional structure that exists to evaluate the ethicality of research projects involving humans. If your organization isn’t doing research on humans, formal REB approval likely isn’t legally necessary, but an REB-type structure can be a good approach to identify and address ethical concerns within your company. Adopting the basic process of an REB is an effective way to determine the most ethical data protection approach and can be used as an ethics oversight process for other areas. An REB model can mitigate ethical risk without requiring an organization to use an actual REB.
Formal REBs use a standard approach to evaluating research proposals for ethical issues. An REB consists of members who are knowledgeable in ethics, law, privacy, science, and a community representative who is not necessarily an expert on any of these disciplines. The REB evaluates research projects, determining if a proposed project is sufficiently ethical by evaluative how it plans to protect data, recruit research participants, and so on.
To consider how this process could translate to a company, let’s imagine you are developing a medical health app for people who want to cut down on smoking cigarettes. Your app would not be considered research, so you would not have to consult an actual REB to develop it. Regardless, it’s in your company’s best interest to ensure that the app is minimizing ethical risk. For example, there could be very real issues with an ineffectual data protection policy for your app. An REB model can help your company anticipate these sorts of issues that, if not foreseen and addressed, could have a serious impact on the people you are trying to benefit with your app as well as the overall success of your company.
Even without access to a formal REB, you can implement the general approach to good data governance and protection that REBs use. Using this structure and guiding frameworks on data protection mean that you can decide before the app hits the market, for example, to add code to the app that anonymizes information. Consultation among the app’s stakeholders, including potential users, would also help identify possible privacy issues and ensure ethical data confidentiality and security.
Minimizing ethical risk requires building explicit processes to identify and address ethical questions before they become problems. Although thinking proactively about ethical issues takes more resources up front, a reactive approach, such as waiting for a data breach and then responding, will be worse for customers and for the company. An REB model is one way to get in front of these problems.