The Office for Human Research Protections (OHRP) IRB Guidebook (2013) defines privacy and confidentiality:
“Privacy can be defined in terms of having control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others. Confidentiality pertains to the treatment of information that an individual has disclosed in a relationship of trust and with the expectation that it will not be divulged to others in ways that are inconsistent with the understanding of the original disclosure without permission.”
Both need to be addressed when creating a data collection plan.
Privacy is about the participant’s right to control their own data. The informed consent provided to participants as part of joining a study will address privacy concerns about the extent, timing, and circumstances of sharing themselves as part of the research. Participants who are concerned about their participation can not consent to participate in the study. There should be an explanation for how the data collection will address the research questions and why the research questions are important to answer. And for observations, participants should know whether they are being observed in the moment or not.
Participants have the right (depending on the study design):
Confidentiality is directly related to how researchers use and protect the data we are given. Personally identifiable information (PII) can potentially harm participants if revealed (e.g., names and grades). One of the best ways to protect your participants is to not collect any PII including name, addresses, emails, social security numbers, or any other identifier that could uniquely identify a participant. Additionally, indirectly identifiable PII could allow a participant to be deduced with reasonable effort (e.g, general information regarding job or affiliations).