I'm a part of the University staff supporting research. I recently became aware of a faculty research project being conducted with a commercially purchased dataset that contains PII. I do not believe the faculty member has submitted the project for IRB review but is conducting the research anyway.
My supervisor's messaging to the the faculty member was 'We recommend any research that uses this dataset be reviewed by the IRB. However, the responsibility is ultimately that of the researcher's to decide whether IRB review is necessary'. As far as I am aware, the faculty member never submitted or received IRB approval. The attitude from our management team was that we shouldn't block research projects, particularly since the faculty member had helped to pay the licensing fees for the dataset. If the faculty member chooses to go ahead without IRB approval, any misuse of the data is solely their responsibility.
Is it correct that all the responsibility lies with the faculty member? What are our responsibilities as staff after we have warned faculty? If I am aware of this situation and I don't report it to the Universities research ethics team, will I be personally responsible for any abuse of the dataset?
This a private University in the United States.