Permissions and ethics
Two gates stand between your design and your data. They are different kinds of thing.
The IRB is an ethics review. It governs research involving people.
A data-use agreement is a contract. It governs somebody else’s proprietary data.
Both take longer than teams expect. Both have to start in the autumn. Neither is something you can grant yourself.
Does your project collect data from people? A survey, an interview, an experiment. If so, start this in October, not February.
The review itself is often quick. Assembling what it needs is not. And training has to be finished before anything can be approved.
If you use only existing data about firms, prices, places or securities, you almost certainly need none of this. Read the first section anyway. “Existing data about people” is the case that catches teams out.
Does this apply to us?
The IRB governs research with human participants. Two questions decide it:
- Is it research? A systematic investigation designed to produce generalisable knowledge. A capstone intended to inform one firm’s decision may not be; one written to say something about people in general is.
- Are there human participants? Either you interact with living people — surveys, interviews, experiments, focus groups — or you use identifiable private information about them.
Teams miss the second half. Scraped social media posts count if individuals are identifiable. So do purchased consumer records and administrative microdata.
Cornell’s IRB office publishes the decision tree its own staff use, and it has a branch for class projects. A project whose sole intent is to meet a course requirement, with no intention to use the results for anything else, is not human participant research. A project whose results leave the course, for a publication, a presentation, a thesis or a sponsor’s decision, is. A capstone is the second kind. The tree has a second page for existing data, and the question it asks is whether you can link a row to a living person, directly or through a code, not what the vendor calls the file.
Foot-traffic and card-spend data of the kind on Dewey arrive aggregated and de-identified. That is normally what puts them outside the definition. But you do not get to make that call yourself. When in doubt, ask, and ask early.
You are not the one who decides you are exempt. Even exempt research needs a determination from the IRB. “We decided it was exempt” is not a category.
How it works at Cornell
The IRB is administered by Cornell Research Services, East Hill Office Building.
Submissions go through RASS-IRB — rass.cornell.edu/irb, with step-by-step guidance at guide.rass.cornell.edu.
Training comes first. Every person listed on a protocol must complete CITI Program human-participants training. That includes exempt protocols, a requirement since October 2022. It lasts five years.
The IRB issues nothing until every listed person has finished. One teammate who skipped the modules holds up the whole team.
The CITI modules are required of every member of a team whose project involves human participants, and session B of meeting 4 is where each team decides whether that is you. Register at citiprogram.org under the Cornell affiliation, take the course Cornell accepts (it is called IRB Training or IRB Basic), and upload the completion certificate to Canvas before meeting 6, Wednesday September 30. Not there by then costs five participation points. The modules take two to four hours. If your project has no human participants you owe nothing now; if the plan changes later, do the modules that week, before the protocol is drafted. The credential lasts five years and is worth having for the research most of you will run inside a firm.
Three levels of review:
| Level | Roughly | What it covers |
|---|---|---|
| Exempt | Most classroom surveys of adults on non-sensitive topics | Still requires an IRB determination |
| Expedited | Minimal-risk research not fitting an exempt category | Reviewed by a member, not the full board |
| Full board | More than minimal risk, or vulnerable populations | Meets on a schedule — plan around it |
Cornell’s own clock, from the IRB office’s page on the life cycle of a protocol: an exemption takes three to four weeks from start to finish, expedited review four to six, and the full board four to eight. The board meets on the first Friday of every month, so its clock is a calendar, not a queue. All three assume a complete submission; an incomplete one goes back and the clock restarts.
Cornell’s own guidance for studies enrolling students asks for submission at least four weeks before enrolment begins, and warns that anything needing an ancillary review takes longer.
What this means for your timeline
| When | What |
|---|---|
| By September 30 (meeting 6) | Teams with human participants complete CITI training and upload the certificate to Canvas. Required and graded for them |
| Meeting 9–10 (late Oct) | You know whether your design needs human participants |
| Late Oct / early Nov | Draft the protocol: instrument, consent language, recruitment, data handling |
| November | Submit through RASS-IRB |
| Spring (AEM 6992) | Collect |
The point of doing it in the fall is that AEM 6992 is where you execute. A protocol still in review in February costs you a third of the semester you were going to run the study in.
What a protocol actually asks for
Less than students fear, but all of it in writing:
- What you will do, step by step, from recruitment to analysis
- Who your participants are, how many, and how you find them
- The instrument itself — the actual survey, the actual script
- Consent language — what you tell people before they agree
- Risks and benefits, stated honestly. For most survey work the risk is boredom and a small privacy exposure; say so rather than claiming zero
- Data handling — where it lives, who sees it, whether it is identifiable, when it is destroyed
- A faculty member, since students generally cannot serve as principal investigator on their own. That is me. I am the faculty advisor on your protocol, so the draft goes past me before it goes to the IRB
Writing the instrument early is not bureaucracy tax. It forces you to decide what you are actually measuring, which is meeting 4.
Data-use agreements
The second gate, and a different animal. A DUA is a contract, not an ethics review, and it is signed by the university rather than by you — which is why you cannot simply accept a firm’s terms on your team’s behalf, however reasonable they look. If a firm gives you proprietary data, expect legal review on both sides, expect it to take months, and expect restrictions on what you may publish.
At Cornell the Office of Sponsored Programs is the party that enters into agreements for the use of data. Write to osp_dua@cornell.edu, and ask in October whether it will sign for a capstone team rather than assuming it will. The agreement binds the university, and it binds you through the university.
Read the licence on data you already have, too. Most of what the library pays for, WRDS and Compustat included, is licensed for academic, non-commercial use. A project a firm would pay for cannot be built on a file whose licence forbids commercial use.
Two consequences worth planning around: you may not be able to show your results, and the agreement may not be signed in time. If your project depends on a DUA, it needs a plan B by meeting 5.
Where the file lives
Cornell classifies data as low, moderate or high risk. Anything under FERPA sits at moderate risk. Identifiers paired with a name, health records and financial account data sit at high risk. Proprietary and licensed data are covered by the same rule.
Nothing at moderate risk or above goes into a publicly available AI tool. That is Cornell’s rule, in its own words, and anything you put into a public tool is treated as public. The approved tools are listed on that page. If the file you hold is not one you may upload, the assistant sees the column names and five invented rows, and the code it writes runs on your laptop.
Removing the names is not de-identification. ZIP code, birth date and sex together identify most Americans uniquely. Coarsen what you do not need at full resolution, and collect only what the question needs.
Where to ask
- The IRB office answers questions before submission, and would much rather hear from you early than fix a protocol later.
- Ask me first if you are unsure whether any of this applies. Usually it does not take long to find out, and the answer changes what you can design.