Rachel Woodbrook
Data Curation Specialist for Humanities, Social Science & Medicine
University of Michigan
https://orcid.org/0000-0002-4548-944X
Amy Ferguson
Special Programs Manager
Data Curation Network
https://orcid.org/0009-0006-9714-3199
The Problem
Over the past several decades, there has been a trend of increasing requirements from funding agencies and publishers to share research data and make it publicly available (Bahlai et al., 2019). However, there is a dangerous gap: without an accompanying increase in the necessary support and resources for researchers to properly evaluate their data before publishing, what should be a public good can cause unnecessary harm to research participants. For example, even when following current best practices, there is a well-established trend of data being “anonymized” and then proven re-identifiable. (See Rocher et al., 2019 for nine separate examples).
Appropriate preparation of data for public sharing is a complex and nuanced task, and researchers need support to navigate the shifting research landscape. Unfortunately, many institutions are still ill-prepared to support this work. There is currently no agreed-upon solution, such as an IRB-equivalent body for data, to provide this support. Because the need for vetting data has grown quickly with increases in open information requirements, existing compliance and risk offices may not be prepared to evaluate complex dataset risks (Mozersky et al., 2020). Legal implications, rapid changes in the US political and funding climate for research (e.g., the impending “Updated Elements of an NIH Data Management and Sharing Plan” (NIH, 2026) explicitly decrease process and planning around data sharing), and technological developments such as AI only add to the uncertainty, making many institutional actors reluctant to take on additional responsibility or even liability.
Where services and support exist, if they are not made highly visible even researchers affiliated with well-resourced institutions may struggle to assess and curate their data for sharing. A lack of institutional integration between offices dealing with different parts of the research cycle often results in disconnection between practices with cascading impact, such as responsible conduct of research training or informed consent and data sharing planning. Regulations cannot keep up with practice, especially in quickly-shifting environments. Unfortunately, this means that even with perfect adherence, following existing requirements such as HIPAA and FERPA is not enough to prevent foreseeable harm.
The Impact
Whether due to restricted resources, competing institutional priorities, or lack of a centralized strategy, researchers and research data professionals can find themselves being asked to determine when data with complex ethical issues, such as de-identification needs, are appropriate to share or publish. If the support needed exceeds their expertise or capacity, research data professionals may also be left without a clear direction in which to point researchers for additional support. For those working at institutional repositories, this can mean rejecting datasets without being able to point to appropriate resources. This shifts the issue but does not solve it, as researchers who opt to then publish in fully self-service open repositories or make data available on their own project or research sites may not be getting additional support or feedback at all.
Because of their often cross-division positions in libraries or other support offices, research data professionals may be in a position to directly observe instances of this disconnect between the directives and policies of funders and publishers around open data, and the practical support, including financial and staffing support, needed to fulfill these requirements responsibly. Research data professionals play an important role in identifying and highlighting gaps or advocating for additional resources in these situations. However, larger cultural shifts, institutional commitments, and collaboration across the research process are needed to meet evolving research data needs. While data sharing requirements rightly make the labor required for publicly useful data more visible, institutions must invest material resources to provide sufficient support. Otherwise, sharing this data may reinforce existing power hierarchies and expose those most vulnerable (both researchers and research participants) to even more risk. Too often, institutions only address known risks after lawsuits or negative publicity. This leaves researchers, individual participants and communities open to harm when preventative action should have been taken. This lack of action may also damage institutional relationships with participant populations, as well as institutional collaborators.
The Risks
Sharing requirements as applied to sensitive data; the general increase in the gathering of both research and commercial data; and the increasing capabilities for connecting disparate datasets or conducting analysis via technologies such as AI all increase the risks associated with publishing data (Lermen et al., 2026; Li, 2026). One major risk for human data is that of re-identification via inference, linkage, or other methods (Rocher et al., 2019; Prakaashana et al., 2025; Berger & Cho, 2019). These risks do not necessarily disappear even with synthesized data (Alshantti et al., 2025). For example, any type of “high-dimensional” medical data (data in which the number of features, p, is larger than the number of observations, N–including body imaging) may be of concern. Similarly, any data recording stable, individual-specific patterns, such as ECGs/EKGs (Wang, 2025) or genomics information, is “inherently vulnerable to deanonymization” (Narayanan and Shmatikov, 2019). On the other end of the scale, if there is not sufficient support to think through the full range of possibilities for data sharing, cautious researchers may turn to blanket denials of their ability to share any data.
What Is Needed
As the issue is systemic, so must be the solution. As the State of Open Data 2025 report concludes, research support for open data has fallen significantly in the last 10 years, which “[…] reinforces the need to pair policy with practical infrastructure and support that makes sharing feasible and genuinely reusable” (Springer Nature et al., 2026). A truly functional data sharing ecosystem requires organizations to recognize the gap in support and expertise for open data sharing, understand its risks, and collaborate and claim ownership of solutions. In addition to research data professionals, such solutions must include perspectives and knowledge from researchers, IT departments, offices of research and sponsored projects (ORSP), IRBs, other compliance offices, regulatory affairs, human participant protection programs, and General Counsels.
In the interim, some organizations may have existing departmental, school, or college support that can help data professionals patch the gap. There are also existing efforts at many institutions, including research data management trainings, informed consent and Data Management and Sharing Plan (DMSP) review, and data curation best practices. Where services such as these exist, a good start is coordination or alignment across campus units. Support from beyond a given institution may also be needed to be ultimately successful. One example of collaborative inter-institutional support is the Data Curation Network (https://datacuration.network/), an organization offering data curation support for institutions via membership and its community of data curators, including a collaborative distributed workflow. This type of effort can ease the burden on smaller or undersupported research data management services by distributing labor and giving them access to a wider variety of disciplinary expertise. With breathing room, research data professionals have more capacity to advocate for resources or explore other options to close data support gaps at their institutions. However, we want to reiterate that these solutions are merely stop-gaps, rather than long term solutions.
Conclusion
While requiring more public data sharing has admirable goals and great potential benefits, a lack of accompanying support to appropriately assess data before its release undermines the ethics and positive contributions to public-researcher relationships that data sharing is meant to bolster. This gap should be addressed before the impact of easily-anticipated harms becomes undeniable. While research data professionals are likely to be a critical part of the advocacy and collaboration needed to address the issue, the larger-scale investment of resources by institutions in support and education for how to ethically meet these requirements is needed. Without additional support, neither individual researchers nor data professionals will be able to adequately mind this gap.
Acknowledgements
Thank you to (in alphabetical order by last name) Heidi Imker, Megan O’Donnell, Sara Samuel, and Joanna Thielen for originating ideas, suggested examples, and draft review.
References
Alshantti A., Rasheed, A., and Westad, F. (2025). Privacy Re-Identification Attacks on Tabular GANs. Security and Privacy, 8(1). https://doi.org/10.1002/spy2.469
Bahlai, C., Bartlett, L.J., Burgio, K.R., Fournier, A.M.V., Keiser, C.N., Poisot, T., & Whitney, K.S. (2019). Open Science Isn’t Always Open to All Scientists. American Scientist, 107(2). https://doi.org/10.1511/2019.107.2.78.
Berger, B., Cho, H. Emerging technologies towards enhancing privacy in genomic data sharing. Genome Biol 20, 128 (2019). https://doi.org/10.1186/s13059-019-1741-0
Bezuidenhout, L., Kelly, A. H., Leonelli, S., & Rappert, B. (2017). ‘$100 Is Not Much To You’: Open Science and neglected accessibilities for scientific research in Africa. Critical Public Health, 27(1), 39–49. https://doi-org.proxy.lib.umich.edu/10.1080/09581596.2016.1252832
Huston, P., Edge, V. L., & Bernier, E. (2019). Reaping the benefits of Open Data in public health. Canada communicable disease report = Releve des maladies transmissibles au Canada, 45(11), 252–256. https://doi.org/10.14745/ccdr.v45i10a01.
Lermen, S., Paleka, D., Swanson, J., Aerni, M., Carlini, N., & Tramèr, F. (2026). Large-scale online deanonymization with LLMs (arXiv:2602.16800). arXiv. https://doi.org/10.48550/arXiv.2602.16800
Li, T. (2026). Agentic LLMs as Powerful Deanonymizers: Re-identification of Participants in the Anthropic Interviewer Dataset (arXiv:2601.05918; Version 1). arXiv. https://doi.org/10.48550/arXiv.2601.05918
Mozersky, J., Walsh, H., Parsons, M., McIntosh, T., Baldwin, K., & DuBois, J. M. (2020). Are we ready to share qualitative research data? Knowledge and preparedness among qualitative researchers, IRB Members, and data repository curators. IASSIST quarterly, 43(4), 952. https://doi.org/10.29173/iq952
Narayanan, A., and Shmatikov, V. ”Robust de-anonymization of large sparse datasets: a decade later. Manuscript, 2019.
Narayanan, A., and Shmatikov, V. “Robust De-anonymization of Large Sparse Datasets,” 2008 IEEE Symposium on Security and Privacy (sp 2008), Oakland, CA, USA, 2008, pp. 111-125, doi: 10.1109/SP.2008.33.
Nelson, A. (2022). Memorandum for the Heads Of Executive Departments and Agencies: Ensuring Free, Immediate, and Equitable Access to Federally Funded Research.https://bidenwhitehouse.archives.gov/wp-content/uploads/2022/08/08-2022-OSTP-Public-Access-Memo.pdf
NIH (2025, August 5). Data Management & Sharing Policy Overview. https://grants.nih.gov/policy-and-compliance/policy-topics/sharing-policies/dms/policy-overview
NIH. (2026, February 25). NOT-OD-26-046: Updated Elements of an NIH Data Management and Sharing Plan. NIH. https://grants.nih.gov/grants/guide/notice-files/NOT-OD-26-046.html
Prakaashana, C.M., Savvides, M., Gunter, J.L., Senjem, M.L., Vemuri, P., Kantarci, K., Graff-Radford, J., Petersen, R.C., Jack, C.R. Jr, and Schwarz, C.G. Measuring the potential risk of re-identification of imaging research participants from open-source automated face recognition software. NeuroImage 320, 121476 (2025). https://doi.org/10.1016/j.neuroimage.2025.121476.
Richterich, A. (2018). The Big Data Agenda Data Ethics and Critical Data Studies (1st ed.). University of Westminster Press.
