Confidentiality and privacy are important aspects of ethical research because a participant ought to have control over whether it becomes public knowledge that they participated in a research study, as well as over the information that they provided while participating in the research. 

Privacy in this context refers to an individual's control over whether and how their information is shared with others. Privacy refers to people and is legally understood as a human right. For privacy purposes, IRBs are concerned about what information is collected, how it is collected, and who knows whether a participant is part of a research study. There are various privacy laws that may be relevant to your research, including the Children's Online Privacy Protection Act (covered on the page about research with children), The Family Educational Rights and Privacy Act (covered on the page about educational research), Title IX and state mandatory reporting laws (covered on the page about researching illegal and illicit acts), and the Health Insurance Portability and Accountability Act (not covered on this website because it is not relevant to CC research).

If privacy is about people, confidentiality is about data and refers to the expectation that information will not be divulged without the permission of the person whose information it is. For confidentiality purposes, IRBs are concerned about who has access to information, how the information is secured, and what will happen to that information once the research has come to an end (will it be destroyed? kept securely?)

Confidentiality often comes down to one or more ways of de-identifying participants, and privacy often comes down to one or more ways of securing information. Confidentiality may be maintained by:

• Giving participants pseudonyms
• Using initials rather than full names
• Not writing down any identifying information in the first place, even if the researcher knows participant names
• Arranging to interact with participants in such a way that the researcher never knows the participants' names in the first place; this is sometimes known as anonymity
• Changing details of the write-up other than just names in order to prevent readers from identifying participants; in some kinds of research it is common to generate a "typical" participant who is not based on any one actual participant but who captures important elements of multiple participants
• Removing certain demographic information from quantitative research, either temporarily or permanently
• Using a consent process where a participant consents without their name being captured either on paper or on a recording
• Destroying identifying information as soon as possible
• Storing field notes, transcripts or questionnaires that have been purged of identifying information separately from any identifying information (e.g., a day timer with appointment names and addresses)
• Avoiding the collection or tracking of IP addresses during online research

Privacy can be maintained by:

• Not leaving questionnaires, interview transcripts, or field notes with participant identifications sitting out where others might see them but rather locking them up
• Using electronic data security measures to lower the odds that, even if one's laptop is stolen, information on it will be easily readable; this might include password protection, encryption, or other measures

It is important to bear in mind that there are circumstances in which participants want their identities to be known, or are at least neutral about the matter. While IRBs tend to work on the assumption that confidentiality and privacy are the default preference of participants, the researcher should inform the IRB if this is not the case for a given project.

Anonymity, a condition of research where it is not possible for the researcher to know the participant's identity, is difficult to achieve in human subjects research. Even a single identifier can often be used to identify a unique individual, and confidential data can often be identified or re-identified. Anonymity is not possible with face-to-face research. For these reasons, the Colorado College IRB focuses on confidentiality rather than anonymity in most instances.