Confidentiality isn’t guaranteed by simply giving someone a secure online survey link. A secure link helps protect data in transit, but many other factors determine whether responses remain confidential. The best answer reflects that it depends on how the study handles data overall: what information is collected, whether data are de-identified, how data are stored and who can access them, the security of the survey platform, how data are transmitted and stored, and what is described in the participant consent and data management plan. Even with encryption and secure access, risks like potential re-identification, data breaches at the platform or server, and whether IP addresses or other identifiers are collected can affect confidentiality. So, you cannot guarantee complete confidentiality just from providing a secure link; it depends on the broader data-security and privacy practices in place.

When harm or concerns arise in research, the focus is on formal, recognized channels that protect participants. The primary route is to raise the issue with the Research Ethics Board (REB) or the institution’s research ethics office. This independent body reviews what happened, checks whether the informed consent process and participant protections were adequate, and determines steps to remedy the situation. Remediation can include a range of actions, such as revising consent materials or the consent process to ensure future participants are better informed, stopping or modifying the study procedures, and offering appropriate supports to the harmed participant—like medical care, counseling, or other services. Institutions may also have policies that outline compensation or other remedies if harm occurred, aligned with legal and policy requirements. The key point is that redress is pursued through established ethical-review channels that are designed to protect participants and uphold research integrity, rather than immediate legal action or other ad hoc options. Other options aren’t the standard first routes. Leaving the study doesn’t address the harm, and financial compensation from a sponsor is not guaranteed or universally available. Pursuing court action as the initial step bypasses the ethical oversight process that exists to safeguard participants and ensure appropriate remedies.

The key idea is balancing accountability with independence. A Research Ethics Board (REB) is established by an institution and is responsible for how it operates—its policies, procedures, membership, training, and record-keeping—so the institution can oversee its functioning. Yet when it comes to evaluating and making decisions on research proposals, the REB must act independently of the institution to prevent bias or pressure from researchers or sponsors. This independence ensures that decisions about participant protections, risk/benefit assessments, consent requirements, and privacy safeguards are based on ethical principles, not institutional interests. So, the correct description is that the REB is accountable to the institution for its operations but independent in its decisions on research proposals. It isn’t fully under government control, and it isn’t independent in all respects from the institution, nor is it accountable in every respect to the institution for its decisions about proposals.

Consent can be given through methods other than a written form. In TCPS 2, the critical requirement is that participants are informed, understand what participation involves, and voluntarily agree to participate with a way to withdraw. Documentation of consent can be written, oral, or another appropriate record, depending on the study’s risks and context. For example, researchers may obtain oral consent for interviews (sometimes with a witness or audio record) or use implied or opt-in consent in low-risk settings. The ethics board reviews whether the chosen method adequately protects participants and records consent when needed. So, consent may indeed be obtained in ways beyond writing.