Scenario:

Andre is a scientist on a medical research team studying the role of genetic factors in psychological disorders. The teams research is focused on how different variants influence social behavior. To facilitate this work, Andre built a tool that link three anonymized data sets: an anonymized set of genetic test results accessible only by medical researchers, a publicly available anonymized database of clinical diagnoses, and a custom database of public social networking posts. To preserve anonymity, the tool substituted all personally identifiable information in the social networking posts with quasi-identifiers. Andres team was granted approval for a study by their ethics review board (ERB), under the condition that all data was anonymous and/or public, and all users had opted in to the data collection.

In the process of testing the tool, Andre found a bug that incorrectly linked some records to multiple individuals as a single person. Since the data sets were all anonymized, the team had accepted that such erroneous matches could possibly occur. The bug increased the expected number of matches, but to only a small extent; as a result, the bug was classified as a low priority. Andre raised concerns that there could possibly be other bugs and suggested the source code be released under an open source license to facilitate peer review of both the tool and the overall research.

Evaluate: How might the decision in this case be used as a foundation for similar future cases? What actions (or lack of action) supported or violated the Code? Are the actions taken in this case justified, particularly when considering the rights of and impact on all stakeholders?