Research Ethics, Law and Governance

Introduction and context

Mass media research is conducted within a complex social and technological environment. A dissertation may involve journalists, audiences, platform users, media organisations, public records, social-media content, audiovisual archives, algorithmic systems, or sensitive information about individuals and communities. The researcher therefore has responsibilities that extend beyond producing valid findings. Research must respect human dignity, protect participants from avoidable harm, comply with applicable law, preserve the integrity of evidence, and communicate findings honestly.

For mass media managers, these responsibilities are strategic as well as moral. An unethical project can expose an organisation to litigation, regulatory penalties, reputational damage, loss of public trust, and exclusion from future research partnerships. Conversely, ethical governance improves data quality, participant cooperation, institutional credibility, and the legitimacy of media decision-making.

Ethics is not a form completed once at the beginning of a project. It is a continuing process of anticipating risks, making defensible decisions, documenting them, monitoring changing circumstances, and being accountable to participants, institutions and the public.

Learning objectives

By the end of this chapter, students should be able to:

1. Explain informed consent, privacy, confidentiality and anonymity in media research.
2. Distinguish ethical obligations from legal duties and organisational policies.
3. Apply copyright, data-protection and intellectual-property principles to research materials.
4. Identify threats to research integrity, including fabrication, falsification, plagiarism, undisclosed conflicts and selective reporting.
5. Design proportionate safeguards for vulnerable participants and sensitive data.
6. Evaluate platform governance, algorithmic bias and responsible use of artificial intelligence.
7. Develop a practical governance plan for a mass media dissertation or project.

1. Ethics, law and governance: related but distinct

Research ethics concerns what researchers ought to do to respect persons, minimise harm, promote fairness and act honestly. Ethical duties may apply even where no statute expressly prohibits an action.

Law consists of enforceable rules made by competent authorities. Relevant areas may include data protection, copyright, privacy, defamation, confidentiality, child protection, intellectual property, freedom of information and computer misuse. Laws vary by jurisdiction; a project involving international participants may be subject to more than one legal regime.

Governance is the system through which responsibilities, approvals, controls, monitoring and accountability are organised. It includes a university ethics committee, data-protection officer, project supervisor, media organisation, platform terms of service and documented research procedures.

These three dimensions overlap but cannot be substituted for one another. Legal compliance is a minimum requirement, not proof of ethical conduct. An activity may be technically lawful yet exploitative or misleading. Similarly, a university policy may impose requirements that exceed statutory obligations.

A useful governance question is: Who is responsible for which decision, on what evidence, under which rule, and with what record of review? This question turns abstract ethical principles into operational practice.

2. Foundational principles

Most contemporary research codes express a common set of principles.

Respect for persons and autonomy

Participants should be treated as decision-makers capable of understanding information and choosing whether to participate. Their choices should not be overridden merely because a researcher considers the project valuable.

Beneficence and non-maleficence

Research should seek meaningful benefits and avoid unnecessary harm. Harm can be physical, psychological, social, economic, legal or reputational. In media studies, foreseeable harms include exposure of political opinions, employment consequences, online harassment, retraumatisation and identification through apparently harmless quotations.

Justice

The burdens and benefits of research should be distributed fairly. Researchers should not recruit disadvantaged groups simply because they are accessible, inexpensive or less able to refuse. Nor should valuable research exclude groups whose experiences are important to the research question.

Respect for communities and the public interest

Media research can affect families, cultural groups, workplaces and online communities. Researchers should consider collective consequences, avoid stigmatising descriptions and communicate findings responsibly. Public interest is not identical to public curiosity.

Integrity and accountability

Researchers must represent methods and findings accurately, retain an auditable record, correct errors and accept scrutiny. A dissertation is not merely a product; it is a chain of accountable decisions.

3. Informed consent

Informed consent is a process through which a competent person voluntarily agrees to participate after receiving adequate information. It normally requires four conditions:

• Disclosure: the researcher explains the purpose, procedures, duration, risks, benefits, data uses, funding, contacts and withdrawal arrangements.
• Comprehension: information is presented in language and a format the participant can understand.
• Capacity: the person is able to make the decision, with appropriate support where necessary.
• Voluntariness: the decision is free from coercion, undue influence and unreasonable pressure.

Consent should be specific enough to cover the proposed activity. A participant agreeing to a recorded interview about news consumption has not necessarily agreed to public release of their voice, image or raw transcript. Consent forms should distinguish among collection, analysis, quotation, archiving, sharing and publication.

Consent is not valid if important information is concealed. Deception can sometimes be justified in minimal-risk research where disclosure would defeat the research purpose, no reasonable alternative exists, the deception is proportionate, and participants are debriefed promptly. Such designs require heightened review.

Withdrawal must be explained realistically. A participant may usually withdraw before data are anonymised or aggregated, but removal may become impossible after publication or after data have been irreversibly de-identified. This limitation must be stated clearly rather than promised away.

Consent in digital and public environments

Public availability does not automatically mean unrestricted ethical use. A public post may have been intended for a limited audience, may contain identifiable personal information, or may be searchable in a way the author did not anticipate. Researchers should examine context, sensitivity, vulnerability, reasonable expectations and the potential consequences of reproduction.

Screenshots and direct quotations are particularly risky because search engines can identify the author. Paraphrasing, removing usernames, aggregating results and seeking permission may reduce risk. Platform terms of service are relevant but do not settle the ethical question.

4. Privacy, confidentiality and anonymity

These terms are related but different.

• Privacy concerns a person’s control over access to themselves, their information, communications and activities.
• Confidentiality is the researcher’s duty to protect information entrusted by a participant and to disclose it only as agreed or legally required.
• Anonymity means that identity is not known or cannot reasonably be linked to the data. True anonymity is often difficult in small samples or qualitative research.

A dataset can be de-identified without being anonymous. Removing names may not be sufficient if age, occupation, location, distinctive quotations and publication history permit re-identification. Researchers should assess direct identifiers, indirect identifiers and combinations of variables.

Confidentiality agreements should define who may access data, for what purpose, for how long and under what conditions. Researchers should avoid collecting identifying information that is not necessary. Data minimisation is both an ethical principle and a practical security measure.

Confidentiality has limits. For example, a researcher may have obligations concerning imminent serious harm, abuse, court orders or mandatory reporting. These limits must be explained before participation wherever reasonably possible. Researchers should never promise absolute secrecy when they cannot guarantee it.

5. Vulnerable participants and unequal power

Vulnerability is contextual rather than a permanent label. It may arise from age, disability, illness, poverty, displacement, imprisonment, immigration status, trauma, dependence on an institution, limited digital literacy, language barriers or unequal power in a workplace or classroom.

Research with vulnerable participants is not automatically prohibited. It requires additional safeguards and a clear justification for inclusion. These may include:

• accessible information sheets and interpreters;
• consent procedures adapted to communication needs;
• independent advocates or guardians where legally and ethically appropriate;
• recruitment through channels that do not expose participation;
• avoiding recruitment by a person who controls grades, employment, benefits or services;
• compensation that reimburses time without becoming coercive;
• distress protocols and referral information;
• a plan for safeguarding disclosures;
• careful decisions about whether quotations, images or locations may be published.

Children require special care because legal capacity and understanding vary. Researchers should obtain child assent in an age-appropriate form and parental or guardian permission where required, while recognising that neither substitutes for respect for the child’s own objection. In some studies, parental consent may itself create risk; such cases require specialist ethical and legal review.

6. Copyright, intellectual property and fair use

Copyright protects original expression, not ideas in the abstract. In mass media research, protected material may include articles, photographs, music, film clips, broadcast recordings, software, datasets, transcripts and website design elements. Ownership may belong to an author, employer, commissioning organisation, broadcaster or licensing body.

Research use is not automatically infringement. Exceptions such as quotation, criticism, review, education or fair dealing/fair use depend on jurisdiction and facts. Relevant considerations commonly include purpose, amount used, transformative character, attribution, market effect and the nature of the work. These are legal tests, not a universal percentage rule.

Good practice includes:

• identifying the rights holder and licence terms;
• using only the amount necessary for the research purpose;
• providing accurate attribution;
• preserving evidence of permissions;
• distinguishing quotation from reproduction;
• not uploading copyrighted material to an unapproved generative-AI service;
• checking whether a platform licence permits downloading, analysis or redistribution.

Data ownership and copyright are not identical. A participant may own copyright in a photograph while the researcher holds a copy for a limited research purpose. A dataset may contain facts that are not individually copyrighted but still be protected by database rights, confidentiality or contract.

7. Data protection and the information life cycle

Data-protection law generally regulates the collection and processing of personal data. Although specific laws differ, recurring principles include lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

A research team should map the complete information life cycle:

1. Plan: define the research question, data fields, lawful basis or institutional authority, risks and retention period.
2. Collect: obtain only necessary data through transparent procedures.
3. Store: use approved systems, access controls and encryption where appropriate.
4. Use: restrict processing to stated purposes and document any change.
5. Share: use agreements, secure transfer and controlled access.
6. Archive or destroy: retain data only as long as justified, then securely delete or anonymise it.

A data-management plan should identify the data controller or responsible organisation, processors and authorised users. It should also specify breach reporting, backup, version control, deletion and procedures for participant requests.

Security controls

Security is layered rather than absolute. Appropriate controls may include:

• strong unique passwords and multi-factor authentication;
• encryption in transit and at rest;
• role-based access and least privilege;
• pseudonymisation with the key stored separately;
• secure institutional storage rather than personal devices;
• tested backups and recovery procedures;
• software updates and malware protection;
• audit logs;
• secure deletion of local copies and paper records;
• staff training and incident reporting.

A breach is not limited to hacking. Misaddressed email, lost equipment, excessive permissions, accidental publication and re-identification may also constitute breaches. A response plan should contain the breach, preserve evidence, assess affected people, notify the responsible authority where required, and communicate honestly with affected participants.

8. Research integrity

Research misconduct usually includes fabrication, falsification and plagiarism.

• Fabrication is making up data, participants, quotations or results.
• Falsification is manipulating materials, procedures or data so that the research record is misleading.
• Plagiarism is presenting another person’s words, ideas, structure or creative work without appropriate acknowledgement.

Questionable practices can also damage integrity: selective reporting, undisclosed exclusion of inconvenient observations, p-hacking, misleading visualisations, ghost authorship, honorary authorship, duplicate publication and failure to preserve a research record.

A responsible dissertation should maintain a dated protocol, recruitment log, consent record, coding framework, analytic decisions, changes to the research question and a clear distinction between evidence and interpretation. Negative or inconclusive results are legitimate results. If a mistake is discovered, the researcher should notify the supervisor or publisher, correct the record and explain the correction.

Authorship should reflect substantial intellectual contribution and accountability. Administrative support, proofreading or access to an organisation does not automatically justify authorship, although contributions should be acknowledged appropriately.

9. Conflicts of interest and independence

A conflict of interest exists when personal, financial, professional or institutional interests could influence—or reasonably appear to influence—research decisions. Examples include a sponsor funding a favourable outcome, a researcher evaluating their own employer, accepting gifts from a platform under study, or supervising participants whose performance affects the researcher’s career.

A conflict is not necessarily wrongdoing. The ethical requirement is disclosure and management. Measures include independent analysis, separation of sponsor influence from publication decisions, preregistration where suitable, dual coding, external review, and a written statement of funding and interests.

Researchers should distinguish advocacy from empirical reporting. A project may have a legitimate normative purpose, but claims must still be supported by transparent methods and evidence. Sponsors may review factual accuracy or confidential information, but they should not have an undisclosed veto over findings.

10. Platform governance and algorithmic bias

Mass media research increasingly depends on platforms whose rules are privately designed and frequently changing. Platform governance includes content moderation, recommendation systems, advertising policies, data access, account suspension, verification, privacy settings and terms of service.

Researchers should document the platform, access date, search terms, interface conditions, account type and relevant policy version. Sampling from a platform is rarely neutral: automated recommendations, deleted content, private accounts, bot activity, language differences and API restrictions shape what can be observed.

Algorithmic bias may enter through training data, labels, proxy variables, optimisation objectives, moderation rules or unequal error rates. A system that performs well on average may still fail disproportionately for minority languages or communities. Researchers should therefore ask:

• Who is represented and who is absent?
• What data-generating process produced the sample?
• Which groups experience false positives or false negatives?
• Are categories imposed by the platform meaningful for the research question?
• Can publication expose individuals to targeting or harassment?

Bias cannot be solved merely by removing a sensitive attribute. Other variables may act as proxies, and fairness criteria can conflict. Researchers should report limitations, test subgroup performance where appropriate, avoid unjustified generalisation and involve affected communities in interpretation.

11. Responsible use of artificial intelligence

AI tools can assist with transcription, translation, coding, search, image analysis and drafting. They can also introduce fabricated citations, hidden training-data problems, privacy loss, copyright disputes, automation bias and opaque decision-making.

Responsible use requires:

• checking whether the tool is approved for confidential or personal data;
• obtaining consent when AI processing is materially different from the stated research procedure;
• not entering identifiable or sensitive data into a public tool without authorisation;
• retaining human responsibility for interpretation and decisions;
• verifying quotations, translations, classifications and citations against source material;
• documenting the tool, version, purpose, prompts where relevant and human review;
• disclosing substantive AI assistance in accordance with institutional policy;
• assessing accessibility, cultural bias and unequal error rates;
• preserving an audit trail of generated outputs used in the research.

AI output is not evidence merely because it is fluent. It is an instrument whose performance must be evaluated for the task and population involved. Synthetic data may reduce privacy risk, but it do not automatically represent real-world distributions and should not be treated as a substitute for empirical validation.

12. A practical governance framework for a dissertation

A useful project governance file can contain the following documents:

The principle of proportionality is central. A low-risk anonymous survey may need simple safeguards, while research involving political dissidents, children, health information or covert observation requires intensive review. Proportionality does not mean ignoring small risks; repeated minor risks can become significant when multiplied across many participants.

Applied case: illustrative investigation of audience reactions to a controversial broadcast

Background

A student media-management team proposes to study online reactions to a documentary alleging discrimination in a national broadcaster. The team plans to collect public posts, quote users by username, interview employees and use an AI tool to classify sentiment.

Problem

The proposed design creates several risks. Public posts may be contextually private; direct quotations may make users searchable; employees may fear retaliation; the topic may cause distress; the AI classifier may misread dialect and sarcasm; and the broadcaster may sponsor the project, creating a conflict of interest.

Analysis

The team first separates the research purposes: understanding themes in audience discussion, assessing employee experiences and evaluating organisational response. Each purpose requires a different data source and consent strategy. It is not defensible to treat all online material as equivalent.

The team conducts a risk assessment and consults the supervisor and ethics committee. It decides not to collect usernames unless essential, records only necessary post content, paraphrases most examples, and seeks permission before publishing distinctive quotations. It recruits employees through an independent channel, explains that managers will not know who participated, and avoids collecting information that could identify a small department.

The team also discloses the broadcaster’s sponsorship and obtains a written commitment that the sponsor cannot suppress results. AI sentiment classification is used only as an exploratory aid. A human coder checks a sample across languages and dialects, records errors, and reports that automated classification is not a definitive measure of opinion.

Approach and solution

The final protocol includes approved consent materials, a secure encrypted workspace, role-based access, a deletion schedule, a codebook, a conflict-of-interest statement and a publication review focused on re-identification. Findings are reported in aggregated form, with carefully selected paraphrased examples. The report distinguishes observed online discourse from the views of the wider population.

Outcome

The project produces a more credible account of audience reaction while reducing foreseeable harm. It does not claim that platform users represent all audiences, and it identifies the limitations of automated classification and platform-based sampling.

Learning points

1. Public accessibility does not remove ethical duties.
2. Consent and confidentiality must be designed around the actual risk of identification.
3. Sponsorship must be disclosed and managed, not hidden.
4. AI can support analysis but cannot transfer accountability from the researcher.
5. Ethical safeguards often improve validity by reducing biased recruitment, careless interpretation and avoidable non-response.

Challenges and limitations

Ethical decision-making rarely produces perfect solutions. Anonymisation can reduce accountability or remove contextual meaning. Detailed consent forms may overwhelm participants. Strict data minimisation may prevent later valuable analysis. Platform research may be impossible without collecting some identifiers. Public-interest investigations may conflict with privacy interests. Researchers must explain these trade-offs and justify their choices rather than pretending that risk has disappeared.

Ethics committees also have limitations. Review may occur before field conditions are known, committees may apply inappropriate assumptions to digital environments, and institutional procedures may be slower than platform change. Researchers should therefore treat approval as authorisation to proceed under stated conditions, not as a guarantee that every later decision is ethical.

Best-practice checklist

Before data collection, confirm that the project has a clear question, proportionate design, documented risks, approved consent process, lawful data plan, copyright permissions, secure storage, conflict disclosures and an incident pathway. During collection, monitor unexpected harms, maintain accurate records, respect refusals and report protocol changes. During analysis, preserve the audit trail, test for bias, protect quotations and distinguish evidence from interpretation. Before publication, review re-identification risk, disclose limitations and funding, verify all claims and remove unnecessary sensitive detail. At closure, archive or destroy data according to the approved plan and document what was done.

Chapter Summary

Ethical mass media research is governed by interconnected principles of autonomy, non-maleficence, beneficence, justice, privacy, confidentiality, integrity and accountability. Informed consent must be understandable, voluntary and appropriate to the uses of data. Public digital content is not automatically free of ethical obligations, and anonymity is difficult when quotations and contextual details permit re-identification. Vulnerable participants require additional safeguards, while copyright and data-protection duties regulate the lawful use and management of media materials.

Research integrity requires accurate records, honest reporting, responsible authorship and disclosure of conflicts. Platform governance shapes what researchers can observe, and algorithmic systems may reproduce unequal representation or error. AI tools can assist research only when their privacy, reliability, bias, copyright and transparency implications are actively managed. A strong governance plan connects risk assessment, consent, data security, legal review, integrity controls, publication review and secure project closure. Ethical governance is therefore both a moral obligation and a foundation for credible, employable and strategically valuable media research.

Key Terms

Research ethics: Principles governing responsible research conduct and protection of people and communities.

Informed consent: Voluntary agreement based on adequate information and understanding.

Privacy: A person’s control over access to their person, activities and information.

Confidentiality: The duty to protect information entrusted by participants.

Anonymity: A condition in which identity cannot reasonably be linked to data.

Pseudonymisation: Replacing identifiers with codes while retaining a separate re-identification key.

Vulnerability: A contextual condition that may increase exposure to harm or reduce ability to refuse.

Data minimisation: Collecting and retaining only data necessary for the stated purpose.

Copyright: Legal protection for original expression and creative works.

Fair dealing/fair use: Jurisdiction-dependent exceptions allowing certain limited uses of protected works.

Research integrity: Honest, transparent and accountable production and communication of knowledge.

Fabrication: Inventing data, participants, quotations or results.

Falsification: Manipulating research materials or processes to create a misleading record.

Plagiarism: Presenting another’s work or ideas without appropriate acknowledgement.

Conflict of interest: An interest that could influence, or appear to influence, research judgement.

Platform governance: Rules and systems controlling participation, content, data and visibility on digital platforms.

Algorithmic bias: Systematic and unjustified differences in automated outcomes across people or groups.

Responsible AI: Human-accountable, transparent, secure and fair use of artificial-intelligence systems.

Data breach: Unauthorised access, disclosure, loss, alteration or destruction of data.

Data-management plan: A documented plan for collecting, storing, using, sharing, retaining and destroying research data.

Review Questions

Short Answer Questions

1. Distinguish privacy, confidentiality and anonymity.
2. What four conditions are normally required for informed consent?
3. Why is public availability of online content not sufficient justification for unrestricted research use?
4. Define fabrication and falsification.
5. Identify three security controls suitable for sensitive research data.

Long Answer Questions

1. Explain how ethical obligations, legal duties and institutional governance interact in a mass media dissertation.
2. Discuss the ethical and methodological challenges of researching vulnerable participants.
3. Explain how copyright and data-protection considerations affect the use of media archives and online content.
4. Evaluate the ways in which platform design and algorithmic systems can bias media research.
5. Develop a governance plan for a dissertation involving recorded interviews and sensitive personal data.

Analytical / Application Questions

1. A researcher wants to quote identifiable posts from a public discussion about a traumatic event. Analyse the risks and propose a defensible alternative design.
2. A media company sponsors a study evaluating its own recommendation algorithm. Identify the conflicts of interest and design safeguards for credible research.
3. A student uses a public AI tool to transcribe interviews containing health information. Assess the ethical, legal and security problems and recommend a compliant workflow.

Multiple Choice Questions with Answers

Question 1

Which condition is essential for valid informed consent?

A. The participant receives adequate information and decides voluntarily.

B. The researcher guarantees that no risk is possible.

C. The participant receives a financial reward larger than the research benefit.

D. The participant agrees that withdrawal will never be permitted.

Correct Answer: A. The participant receives adequate information and decides voluntarily.

Question 2

Which statement best distinguishes confidentiality from anonymity?

A. Confidentiality protects entrusted information, while anonymity means identity cannot reasonably be linked to data.

B. Confidentiality applies only to published research, while anonymity applies only to interviews.

C. Confidentiality means data are public, while anonymity means data are encrypted.

D. The terms have exactly the same meaning.

Correct Answer: A. Confidentiality protects entrusted information, while anonymity means identity cannot reasonably be linked to data.

Question 3

Which practice most directly supports data minimisation?

A. Collecting every potentially useful demographic variable.

B. Collecting only information necessary for the stated research purpose.

C. Keeping identifiable data indefinitely for possible future projects.

D. Sharing raw data widely to improve transparency.

Correct Answer: B. Collecting only information necessary for the stated research purpose.

Question 4

Which of the following is fabrication?

A. Correcting a typographical error in a table.

B. Reporting a limitation of the sampling method.

C. Inventing interview participants and quotations that were never collected.

D. Using a pseudonym for a participant.

Correct Answer: C. Inventing interview participants and quotations that were never collected.

Question 5

Why can a direct quotation from a public social-media post create privacy risk?

A. It automatically changes the copyright owner.

B. Search engines may make the author identifiable even when the username is removed.

C. Public posts are always illegal to analyse.

D. Quotation prevents any form of anonymisation.

Correct Answer: B. Search engines may make the author identifiable even when the username is removed.

Question 6

Which action is an appropriate response to a conflict of interest?

A. Hide the conflict so readers do not question the findings.

B. Disclose and manage it through safeguards such as independent analysis.

C. Allow the sponsor to remove unfavourable findings without disclosure.

D. Stop documenting the funding arrangement.

Correct Answer: B. Disclose and manage it through safeguards such as independent analysis.

Question 7

Which statement about responsible use of AI in research is most accurate?

A. Fluent AI output is automatically reliable evidence.

B. Human researchers remain responsible for verifying and interpreting AI-assisted outputs.

C. AI tools eliminate the need to protect personal data.

D. AI classification is unbiased when it uses a large dataset.

Correct Answer: B. Human researchers remain responsible for verifying and interpreting AI-assisted outputs.

Question 8

Which control best reflects the principle of least privilege?

A. Giving every project member full administrator access.

B. Allowing each authorised user only the access needed for their role.

C. Storing passwords in a shared public document.

D. Removing all access logs.

Correct Answer: B. Allowing each authorised user only the access needed for their role.

Question 9

What is the main purpose of a data-management plan?

A. To guarantee that every research result will be statistically significant.

B. To document how data will be collected, secured, used, shared, retained and destroyed.

C. To replace the requirement for informed consent.

D. To permit unlimited reuse of personal data.

Correct Answer: B. To document how data will be collected, secured, used, shared, retained and destroyed.

Question 10

Which example best illustrates falsification?

A. Declaring that a study has inconclusive results.

B. Changing recorded observations to support a preferred conclusion.

C. Obtaining ethics approval before recruitment.

D. Paraphrasing a source with attribution.

Correct Answer: B. Changing recorded observations to support a preferred conclusion.