Ethical Issues in Data Collection: Navigating Privacy and Consent

Researchers across the life sciences, social sciences, and technology fields face a common challenge: how to collect data that serves scientific and practical purposes while respecting the rights and expectations of the people who provide that data. This article addresses the core ethical issues in data collection, including informed consent, privacy protection, anonymization, data security, and the responsible handling of sensitive information. The practical outcome is a working framework for ethical data collection that researchers can apply to their own projects, complete with a checklist for ethical data collection and a template for data management plans.

The Scope of Ethical Data Collection

Ethical data collection begins with recognizing that data represents people. Every dataset containing information about individuals carries obligations that extend beyond the immediate research question. The ethical issues in data collection are not abstract philosophical concerns but practical decisions that affect research quality, participant trust, and the social acceptability of scientific work.

Data ethics involves more than compliance with institutional review boards or legal requirements. As researchers have noted, ethical oversight and constraints are needed to ensure that the benefits of data collection are balanced against the potential for misuse [10]. The challenge is particularly acute because data and data science are ubiquitous, affecting all aspects of life, and because of the intrinsic complexity of data systems [10].

The scope of ethical data collection includes several distinct but interconnected areas. Informed consent addresses how researchers obtain permission for data use. Privacy protection involves controlling access to personal information. Anonymization concerns the removal or transformation of identifying details. Data security covers the technical and organizational measures that protect data from unauthorized access. Each of these areas requires specific decisions and documentation.

Core Ethical Principles for Data Collection

Informed Consent as a Foundation

Informed consent is the cornerstone of ethical data collection. The principle requires that participants understand what data will be collected, how it will be used, who will have access to it, and what risks and benefits are involved. Consent must be voluntary, informed, and given without coercion or undue influence.

The practical challenges of informed consent become apparent in large-scale data collection. When researchers use existing data sources, such as web archives or institutional records, the original consent may not cover the new purpose. This situation, described as data creep, involves repurposing data for applications beyond the conditions of original collection [12]. Data creep has proven controversial and has prompted concerns about the scope of ethical oversight [12].

Institutional review boards offer limited guidance regarding big data, and problematic research can still meet ethical standards [12]. Researchers must therefore go beyond institutional requirements and consider whether their data use aligns with the reasonable expectations of the people whose data they hold.

Privacy and Confidentiality

Privacy protection requires researchers to control access to personal information and to prevent unauthorized disclosure. Confidentiality is the obligation to protect information shared in confidence. Both concepts are central to ethical data collection, particularly when data involves health information, personal behaviors, or other sensitive topics.

The ethical analysis of big data has identified privacy, including anonymization and data protection, as one of five key areas of concern [11]. Privacy protection is complicated by the fact that data can be combined across sources to reveal information that was not apparent in any single dataset. Researchers must consider the full context of data use, beyond the immediate collection purpose.

Data Ownership and Control

Questions of data ownership arise when researchers collect information from participants or from existing sources. Who owns the data? Who has the right to control its use? These questions are particularly complex in collaborative research, in community-based studies, and when data is collected from historically marginalized groups.

The concept of data sovereignty has emerged as an important framework for addressing ownership questions. Indigenous governance of data processes in clinical registries provides an instructive example. A review of 107 clinical registries in Australia found that only 8 registries (7 percent) reported Aboriginal and Torres Strait Islander representation on their governance or steering committees [6]. This lack of representation means that communities remain invisible in data used to inform policy, clinical models of care, health services, and initiatives [6]. Researchers collecting data from specific communities should consider how those communities can participate in data governance.

At a Glance: Ethical Data Collection Decision Framework

Practical Workflow for Ethical Data Collection

Step 1: Define the Data Collection Purpose

Before collecting any data, researchers should clearly define the purpose of the collection. What question is being addressed? What data is needed to answer that question? What decisions will be made based on the data?

The tuberculosis elimination literature provides a useful model for thinking about data collection purpose. Successful disease elimination campaigns are characterized by locally tailored responses informed by appropriate data [9]. The three-step process includes improved collection and use of existing programmatic data, collection of additional data to inform tailored responses, and targeted collection of novel data to improve understanding of transmission dynamics [9]. Researchers should similarly consider what data already exists before collecting new data.

Step 2: Assess Ethical Risks

Ethical risk assessment should identify potential harms to participants, communities, and researchers. Risks can include privacy breaches, stigmatization, discrimination, and psychological distress. The assessment should consider both the immediate collection context and the potential future uses of the data.

The ethical implications of big data are not always apparent at the time of collection. Five key areas of concern have been identified: informed consent, privacy including anonymization and data protection, ownership, epistemology and objectivity, and big data divides created between those who have or lack the necessary resources to analyze increasingly large datasets [11]. Researchers should consider each of these areas in their risk assessment.

Step 3: Design Consent Procedures

Consent procedures should be designed to ensure that participants understand what they are agreeing to. This requires clear communication about the data collection purpose, the types of data being collected, how the data will be used, who will have access, and what protections are in place.

Traditional text-based informed consent may be insufficient for some types of data collection. Virtual reality data and its privacy regulatory challenges have prompted calls to move beyond text-based informed consent [21]. Researchers working with novel data types should consider whether their consent procedures adequately inform participants about the nature of the data being collected.

Step 4: Implement Privacy Protections

Privacy protections should be implemented throughout the data lifecycle, from collection through storage, analysis, and sharing. Technical measures include encryption, access controls, and secure storage. Organizational measures include training, policies, and accountability mechanisms.

Privacy-preserving techniques are being developed for specific data types. For example, eye-tracking data in extended reality systems presents significant privacy risks, including the potential leakage of biometric identity and sensitive behavioral information [17]. Privacy-by-design approaches can protect biometric data at the sensor level, within real-time data streams, and through formal privacy guarantees applied to datasets [17]. Researchers should consider what privacy-preserving techniques are appropriate for their data type.

Step 5: Plan for Data Sharing and Reuse

Data sharing and reuse can increase the value of research data, but they also create ethical obligations. Researchers should plan for data sharing at the outset of their projects, considering what data can be shared, under what conditions, and with what protections.

Anonymization is a key consideration for data sharing. Generative models pose significant privacy risks when synthetic outputs closely resemble the real, personal images required for training [18]. A two-stage framework for generating privacy-preserving synthetic eye images demonstrated that privacy threat detection rates above 97 percent are achievable, with a trade-off between realism and privacy protection [18]. Researchers should evaluate the adequacy of their anonymization approaches for the specific data types they handle.

Options and Tradeoffs in Data Collection Ethics

Anonymization Approaches

Anonymization involves removing or transforming identifying information so that individuals cannot be identified from the data. Different approaches offer different levels of protection and different impacts on data utility.

Simple anonymization removes direct identifiers such as names, addresses, and identification numbers. This approach is easy to implement but may not protect against re-identification when data can be combined with other sources. Statistical approaches, such as differential privacy, provide formal guarantees about the information that can be learned about individuals from a dataset.

Differential privacy provides a theoretical framework to limit the influence of a single sample in a statistical sense, giving strict privacy protection for data publishing and model training [16]. A deep convolutional generative adversarial network framework based on differential privacy demonstrated that privacy and generation quality can be balanced, achieving high accuracy while maintaining resistance to membership inference attacks [16]. Researchers should consider whether formal privacy guarantees are appropriate for their data.

Consent Models

Different consent models offer different tradeoffs between participant autonomy and research practicality. Specific consent requires separate permission for each data use. Broad consent seeks permission for a range of future uses. Dynamic consent uses digital tools to allow participants to manage their preferences over time.

The choice of consent model should reflect the nature of the data, the research context, and participant expectations. For data that may be used for multiple purposes over time, dynamic consent may be more appropriate than a one-time consent. For data with limited future use, specific consent may be sufficient.

Data Security Measures

Data security measures range from basic password protection to advanced encryption and federated learning approaches. The appropriate level of security depends on the sensitivity of the data and the risks of unauthorized access.

Federated learning offers an approach that confines raw measurements to local devices and exchanges only model parameters across tiers [20]. A federated deep learning framework for intrusion detection in power networks demonstrated that privacy can be preserved through a layer-selective mechanism combining homomorphic encryption on sensitive gradient slices with calibrated differential privacy on residual components [20]. This approach suppressed membership inference advantage to below 0.08 while maintaining detection quality [20]. Researchers working with distributed data sources should consider whether federated approaches are appropriate.

Records and Measurements for Ethical Data Collection

Documentation Requirements

Ethical data collection requires documentation at every stage. Researchers should maintain records of consent procedures, data collection protocols, privacy protections, data sharing decisions, and any incidents or breaches.

The Research Data Framework from the National Institute of Standards and Technology provides a structure for thinking about research data management [1]. Researchers should consult this framework when developing their documentation practices.

Auditing Ethical Compliance

Regular audits can help researchers identify and address ethical issues in their data collection practices. Audits should review consent documentation, privacy protections, data security measures, and compliance with institutional requirements.

The clinical registry audit provides a model for assessing ethical compliance. The review of 107 clinical registries found that human research ethics approval was reported in 94 registries (88 percent), with only 11 (12 percent) having Aboriginal human research ethics committee approval [6]. This finding demonstrates that even when ethics approval is obtained, the specific requirements of affected communities may not be met. Researchers should audit their own practices against the highest applicable standards.

Measuring Participant Understanding

Measuring whether participants actually understand what they have consented to is an important but often overlooked aspect of ethical data collection. Researchers can assess participant understanding through follow-up questions, comprehension checks, or debriefing sessions.

The circumstances of consent and the degree to which participants are informed are not always apparent, as many data are a product of creep [12]. Researchers should verify that their consent procedures are achieving their intended purpose of informing participants.

Common Failure Patterns in Ethical Data Collection

Consent as a Formality

A common failure is treating consent as a bureaucratic requirement instead of a meaningful process. When consent forms are lengthy, technical, or presented in a way that discourages questions, participants may sign without understanding what they are agreeing to. This failure undermines the ethical foundation of the research.

Data Creep

Data creep occurs when data collected for one purpose is used for another purpose without additional consent. This can happen when researchers find new uses for existing data, when data is shared with collaborators who have different research questions, or when data is repurposed for commercial applications. Data creep has proven controversial and has prompted concerns about the scope of ethical oversight [12].

Inadequate Anonymization

Anonymization failures occur when researchers believe data is de-identified when it is not. Re-identification can occur through the combination of multiple data sources, through the analysis of unique combinations of attributes, or through the application of advanced analytical techniques. Researchers should test their anonymization approaches against realistic re-identification threats.

Security Breaches

Security breaches can expose personal data to unauthorized parties. Breaches can result from technical failures, human error, or malicious attacks. The consequences of a breach depend on the sensitivity of the data and the harm that can result from its exposure.

Ignoring Community Interests

Research that affects specific communities, particularly marginalized communities, requires attention to community interests and governance. The clinical registry review found that only 8 of 107 registries (7 percent) reported Aboriginal and Torres Strait Islander representation on their governance or steering committees [6]. This failure to include community representation means that data governance does not reflect the interests of the people whose data is being collected.

Limitations and Contextual Considerations

Jurisdiction-Specific Requirements

Ethical requirements for data collection vary by jurisdiction. Researchers must be aware of the legal requirements that apply to their work, including data protection laws, research ethics regulations, and sector-specific requirements. The international and European positions regarding the application of genetically modified organisms, including European Directives, Regulations, and ethical guidelines, illustrate how regulatory frameworks can shape research practices [8]. Researchers should consult legal experts or institutional ethics officers to understand the requirements that apply to their specific context.

Emerging Data Types

New data types create new ethical challenges. Virtual reality data, eye-tracking data, biometric data, and data from wearable devices all present privacy risks that may not be addressed by traditional ethical frameworks. Virtual reality data and its privacy regulatory challenges have prompted calls to move beyond text-based informed consent [21]. Researchers working with emerging data types should stay informed about developing ethical guidance.

Resource Constraints

Ethical data collection requires resources, including time, expertise, and technology. Researchers with limited resources may struggle to implement comprehensive privacy protections or to conduct thorough ethical reviews. The big data divide between those who have or lack the necessary resources to analyze increasingly large datasets is itself an ethical concern [11]. Researchers should be transparent about the limitations of their ethical protections and should seek to address resource constraints where possible.

Quality and Welfare Controls

Ethical Review Processes

Institutional ethics review is a key quality control for data collection. Ethics committees review research protocols to ensure that they meet ethical standards and that participant welfare is protected. However, institutional review boards offer little guidance regarding big data, and problematic research can still meet ethical standards [12]. Researchers should view ethics review as a minimum standard instead of a complete solution.

Data Quality Controls

Ethical data collection is linked to data quality. Poor quality data can lead to incorrect conclusions, wasted resources, and harm to the populations that the research is intended to benefit. The tuberculosis elimination literature emphasizes that locally tailored responses require appropriate data [9]. Researchers should implement quality controls throughout the data collection process.

Participant Welfare Monitoring

Monitoring participant welfare during and after data collection can identify and address harms that were not anticipated in the initial ethical review. Researchers should have procedures for responding to participant concerns and for addressing adverse events.

Safety and Regulatory Context

Data Protection Regulations

Data protection regulations establish legal requirements for the collection, use, and storage of personal data. Researchers must comply with the regulations that apply to their work, including requirements for consent, data minimization, purpose limitation, and security.

The integration of legal and policy considerations into computational mechanisms can ensure robust data privacy protection while maintaining data utility [19]. A methodology called the Legal Privacy Dynamics Encoder incorporates legal and policy considerations into computational mechanisms through three interconnected modules: the Constraint-driven Policy Mapper, the Agent-based Compliance Forecaster, and the Uncertainty-aware Risk Evaluator [19]. This approach demonstrates that legal compliance and data utility can be balanced.

Research Ethics Guidelines

Research ethics guidelines provide professional standards for ethical data collection. The EQUATOR Network provides reporting guidelines for health research [2]. The Experimental Design Assistant from the NC3Rs supports researchers in designing robust experiments [3]. Researchers should consult these resources when planning their data collection.

Professional Escalation Criteria

Researchers should know when to escalate ethical concerns to institutional authorities. Escalation is appropriate when there is a risk of serious harm to participants, when there is a significant breach of privacy or security, when there is a conflict of interest that cannot be resolved, or when there is uncertainty about the ethical acceptability of a research practice.

The ethical challenges of conducting research within highly regulated contexts can create unintended consequences. In one ethnographic study, some employees either did not wish to be protected or felt compelled to reveal their identities, raising questions about their motivation and creating a paradox of unintended consequences [13]. Researchers should be alert to situations where ethical protections create unexpected outcomes and should seek guidance when these situations arise.

Practical Implementation Steps

Developing a Data Management Plan

A data management plan documents how data will be collected, stored, protected, shared, and preserved. The plan should address ethical considerations at each stage of the data lifecycle.

The Research Data Framework from the National Institute of Standards and Technology provides a structure for research data management [1]. Researchers should use this framework to develop comprehensive data management plans.

Creating an Ethical Data Collection Checklist

An ethical data collection checklist can help researchers ensure that they have addressed all relevant ethical considerations. The checklist should be specific to the research context and should be reviewed at multiple points throughout the research process.

A checklist of topics that need to be considered for data ethics has been developed, covering the nature of data, personal data, data ownership, consent and purpose of use, trustworthiness of data as well as of algorithms and of those using the data, and matters of privacy and confidentiality [10]. Researchers should adapt this checklist to their specific research context.

Training and Capacity Building

Ethical data collection requires knowledge and skills that may not be part of standard research training. Researchers should seek training in research ethics, data protection, and privacy-preserving techniques. Institutions should provide ongoing training opportunities for researchers at all career stages.

Engaging Communities

Community engagement can improve the ethical quality of data collection, particularly when research affects specific communities. Engagement should occur at all stages of the research process, from study design through data governance and dissemination.

The clinical registry review demonstrates the importance of community engagement. The significant variability in clinical registry recording of Indigenous governance of data means that Aboriginal and Torres Strait Islander communities remain invisible in data used to inform policy, clinical models of care, health services, and initiatives [6]. Radical change is required to facilitate meaningful change in quality indicators for clinical registries nationally [6]. Researchers should consider how their own data collection practices can better include affected communities.

Professional Escalation Criteria

Researchers should escalate ethical concerns to institutional authorities in the following situations:

• When there is a risk of serious harm to participants that was not anticipated in the ethical review
• When there is a significant breach of privacy or security that could expose personal data
• When there is a conflict of interest that cannot be resolved through normal procedures
• When there is uncertainty about the ethical acceptability of a research practice
• When community concerns about data collection cannot be addressed through normal engagement processes

Escalation should be documented, and the outcomes of escalation should be recorded for future reference.

Frequently Asked Questions

What is informed consent in data collection?

Informed consent is the process of obtaining voluntary agreement from participants to collect and use their data. Consent must be informed, meaning that participants understand what data will be collected, how it will be used, who will have access, and what risks and benefits are involved. Consent must also be voluntary, meaning that participants can refuse or withdraw without penalty. The practical challenge is ensuring that consent is meaningful, particularly when data may be used for purposes that were not anticipated at the time of collection.

How does anonymization protect privacy in data collection?

Anonymization removes or transforms identifying information so that individuals cannot be identified from the data. Simple anonymization removes direct identifiers such as names and addresses. Statistical approaches such as differential privacy provide formal guarantees about the information that can be learned about individuals from a dataset. Anonymization is not always perfect, and researchers should test their approaches against realistic re-identification threats. The adequacy of anonymization depends on the data type, the context of data use, and the resources available to potential re-identifiers.

What is data creep and why is it an ethical concern?

Data creep is the repurposing of data for applications beyond the conditions of original collection. This can occur when researchers find new uses for existing data, when data is shared with collaborators who have different research questions, or when data is repurposed for commercial applications. Data creep is an ethical concern because participants may not have consented to the new uses, and the new uses may create risks that were not anticipated at the time of collection. Institutional review boards offer limited guidance regarding big data, so researchers must consider whether their data use aligns with the reasonable expectations of the people whose data they hold.

What are the main ethical issues in big data collection?

The main ethical issues in big data collection include informed consent, privacy including anonymization and data protection, ownership, epistemology and objectivity, and big data divides created between those who have or lack the necessary resources to analyze increasingly large datasets. Additional areas of concern include the potential for data to be used in ways that harm individuals or communities, the difficulty of providing meaningful consent for complex data uses, and the challenge of ensuring that data analysis is objective and trustworthy.

How should researchers handle data from vulnerable populations?

Researchers collecting data from vulnerable populations should take additional precautions to protect participant welfare. This includes ensuring that consent procedures are appropriate for the population, that privacy protections are robust, and that the research does not create or reinforce stigma. Researchers should also consider community governance structures and include community representation in data governance. The clinical registry review found that only 8 of 107 registries (7 percent) reported Aboriginal and Torres Strait Islander representation on their governance or steering committees, demonstrating that community representation is often lacking.

What is the role of institutional review boards in data collection ethics?

Institutional review boards review research protocols to ensure that they meet ethical standards and that participant welfare is protected. However, institutional review boards offer limited guidance regarding big data, and problematic research can still meet ethical standards. Researchers should view ethics review as a minimum standard instead of a complete solution and should consider the ethical implications of their work beyond what is required by institutional review.

How can researchers balance data utility with privacy protection?

Balancing data utility with privacy protection requires careful consideration of the specific data, the research purpose, and the risks of disclosure. Formal privacy approaches such as differential privacy can provide strong privacy guarantees while preserving data utility. The quantization mechanism has been shown to achieve better privacy-utility tradeoffs than randomized response in certain settings [15]. Researchers should evaluate the available approaches and select the one that best meets their needs.

What should be included in a data management plan?

A data management plan should document how data will be collected, stored, protected, shared, and preserved. The plan should address ethical considerations at each stage of the data lifecycle, including consent, privacy, anonymization, security, and data governance. The Research Data Framework from the National Institute of Standards and Technology provides a structure for research data management [1]. Researchers should use this framework to develop comprehensive data management plans that address the specific requirements of their research context.

Related Articles

• Bacterial Genome Annotation: A Practical Quality Checklist
• Research Data Management Plan: From File Naming to Long-Term Sharing
• Protein Data Bank
• Protein Data Bank
• Protein Data Bank

References and Further Reading

• Research Data Framework. National Institute of Standards and Technology.
• EQUATOR Network. EQUATOR Network.
• Experimental Design Assistant. NC3Rs.
• NCBI Literature Resources. National Center for Biotechnology Information.
• PubMed. National Library of Medicine.
• Indigenous governance, ethics and data collection in Australian clinical registries.. The Medical journal of Australia, 2024.
• Web archives for data collection: An ethics case study.. Accountability in research, 2025.
• Genetically modified organisms: do the benefits outweigh the risks?. Medicina (Kaunas, Lithuania), 2008.
• Data for action: collection and use of local data to end tuberculosis.. Lancet (London, England), 2015.
• Aspects of Data Ethics in a Changing World: Where Are We Now?. Big data, 2018.
• The Ethics of Big Data: Current and Foreseeable Issues in Biomedical Contexts.. Science and engineering ethics, 2016.
• Modeling Ethics: Approaches to Data Creep in Higher Education.. Science and engineering ethics, 2021.
• The ethics of data collection: unintended consequences?. Journal of health organization and management, 2010.
• The impact of elderly privacy fatigue on the willingness to use wearable devices: the mediating role of perceived risk and the moderating role of self-efficacy.. 2026.
• Statistic Maximal Leakage.. 2026.
• DP-DCGAN: Differential Privacy-Deep Convolutional Generative Adversarial Networks with Adaptive Gradient Perturbation. 2026.
• Providing Privacy for Eye-Tracking Data With Applications in XR.. 2026.
• Ensuring data protection for eye images by combining fine-tuned image synthesis and anonymity assessment.. 2026.
• Data privacy protection in public health frameworks via legal and policy integration.. 2026.
• Federated deep learning for distributed intrusion detection and privacy preservation in power networks.. 2026.
• Virtual Reality Data and Its Privacy Regulatory Challenges: A Call to Move Beyond Text-Based Informed Consent. 2022.
• Data Collection Methods in Monitoring and Evaluation: Quantitative, Qualitative, and Mixed Approaches. NEYA Global Journal of Non-Profit Studies, 2025.
• Sex and Gender Identity: Data Collection and Language Considerations for Human Research Ethics Committees and Researchers. Journal of Academic Ethics, 2025.
• What is the length of a toilet paper tube? A hands-on, team-based lesson in the ethics of data collection. ASEE Annual Conference and Exposition Conference Proceedings, 2016.
• Navigating Market Research Ethics in the Technological Landscape: A Comprehensive Analysis of Data Collection Practices and Public Perceptions. International Conference on Computer and Communication Engineering Technology Ccet, 2024.

This article is educational and does not replace institutional policy, professional advice, or applicable safety and regulatory requirements.