Well, it didn’t take me long to find something I’d left out of the list of ethical questions that LIS editors and reviewers should consider in my last post. (I mean, it’s kind of there if you squint, but not really.) It’s this: authors must clear any ethics reviews required of their research by their institutions. If a required institutional review has not been performed, it’s desk-rejection time—don’t even bother sending the piece to peer reviewers.

The lazy, cover-your-butt way for a journal to handle this process is a checkbox during the submission process: “my research has undergone all reviews, including ethics and human-subject research reviews, required by my institution.” Preferable would be a required statement in the article itself, either spelling out what review happened, or spelling out why (per institutional policy) review was not required. Boilerplate language from the journal is not appropriate here, because institutional review policies and practices differ!

I don’t think the journal is required to research institutional review processes when the author hasn’t, mind you, though in a developmental-editing process I think it appropriate for the editor to help out. If it’s brought to the attention of the editors post-publication that a required review hasn’t happened, though, it’s time to investigate, and if the conclusion is that required review was not performed, immediate retraction is the only ethical course. Reporting the author to their institution’s research-integrity office is also appropriate, and I would argue necessary.

So. How does the article at issue here stack up? Were all necessary reviews performed?

Here is a 2020 “tip sheet” from York University (MS Word) on when human-subjects review is required there. It’s refreshingly clear!

“Research” is defined as an undertaking intended to extend knowledge through a disciplined inquiry or systematic investigation. [TCPS, Article 2.1].

So far, so applicable.

A human participant is defined as “a living individual about whom an investigator conducting research obtains data, either through intervention or interaction with the individual or through identifiable private information.”

Library patrons check out (heh) under this definition; the data used in the article were not only identifiable, but fully identified.

Researchers should ask the following questions to help determine what kind of activities require an ethics review…

• Does your project involve using data about people previously collected by someone else (e.g., student or commercial records)?

The author could, I suppose, try to argue that he is not “someone else” since collecting the proxy-server records is within the scope of his job… but I find this excuse flimsy at best, as published research using the records is not within that scope, and he is not the library, so his uses are not automatically coterminous with theirs.

If you answered ‘yes’ to any of the above questions, then your research is subject to ethics review and approval.

And there we have it. This research should have undergone ethics review at York, and there is no evidence in the article that it actually did. I believe that the code4lib journal editorial board is required to investigate this absence, and to retract the article if no review was performed at York.

Becky Yoose also pointed out to me (thank you, Becky!) that there’s a separate process to request personal information about York University affiliates for research use, and the article shows no evidence that this process was followed, nor that York employees are somehow exempt from it.

I’ve been holding my tongue on this situation, because I know that incident response takes time. That article has been out for more than a month, however, with no indication whatever that the code4lib journal editorial board is so much as considering taking action.

I will wait one more week before I report this ethical lapse to York University, to leave room for the journal editors to decide to do the right thing, which would be retracting the article and reporting the lapse to York themselves. If they do not make that report by then, however, I will. It’s my duty, both as a librarian and as someone who tries like all hell to do and review research ethically.