EDIT: I originally tried to make the context as brief as possible, but I may have overdone it.


I'm starting to put some data analysis I'm asked to do on Github, and licensing all my work (mostly R scripts and markdown files displaying statistics, graphs and brief result descriptions). These are mostly medical and health research projects by graduate students. Faculty there usually ask for help in statistics/design and suggest their students do the same. Since I'm new, most of them are coming to me. Although I don't think it's relevant in this question, I have recently been offered a part-time position there for this exact purpose.


The main reason for this is to provide the user student an always up to date version of the current work in progress. If something is quick to fix, say in a graph, they have an instant updated version of the current report I'm writing (usually in markdown).

I also like the transparency I offer to the researchers that ask for my help when I show the development process, what issues I have identified and the overall organization of my work.

Since most of them are not that tech-savy, I prepare the repo with plenty of README.md and other markdown files so they visualize the results and get relevant files without the need to create a github account. They usually report issues to me by email, and I open and close GH issues myself based on their feedback.

Perceived problem

It just hit me that, while my own work is my own to license the way I want, the dataset is not. I didn't participate in the collection, or curation of it. The first step I take before pushing anything to the public repository is to anonymize the dataset.

I usually show the users students the repositories of previous projects, and indicate they'll have such access to their results in a similar fashion. So far, no one has complained about their data being online. One of those projects I show is from a student of an IRB member.


  • Should I ask each user if they want me to remove the datasets from their repository?
  • EDIT: would it suffice to put a warning on the repository that the dataset is not licensed the same way the code, graphs and other contents therein available?
  • Should I remove all such datasets regardless? Why or Why not?
  • Is there something else I might be missing about this scenario?
  • I found this question (and accepted answer) enlightening, although it doesn't respond my question
    – philsf
    Commented Jan 31, 2016 at 3:13
  • 2
    Fomite's answer is already very complete, but additionally I wonder whether "you own work really is your own to license the way you want" because "These are mostly medical and health research projects by graduate students". If you've incorporated their research into your R projects, copyright might not be that simple.
    – Fasermaler
    Commented Jan 31, 2016 at 11:12
  • @Fasermaler, good point. I meant I wanted to open source my code. What would you suggest?
    – philsf
    Commented Jan 31, 2016 at 11:14
  • 1
    I'd talk to the head of the group (or at least the one who offered you that position) to make sure there are no problems with you publishing the code and/or dataset. If it's previously published work, this might be no problem, data privacy concerns aside. If it's unpublished work or the group is expecting to get further results from the study, it may very well be undesirable for them to have the data and analyses 'out there' at this point. You might want to take it offline until you get express permission, particularly with medical research.
    – Fasermaler
    Commented Jan 31, 2016 at 11:34
  • 4
    I know a number of security researchers who have had a lot of fun with "anonymized" databases...
    – Ric
    Commented Feb 1, 2016 at 23:12

4 Answers 4


Once the data is out in public, asking for it to be taken down is just theater.

Data collected by others, presumably giving the people from which it was collected explicit or implicit guarantees it was only to be used in so-and-so way, first doesn't belong to you to publish, and if it was yours, you can't publish it anyway without violating the agreement with the real owners, the people to which it applies.

I'd say you can not publish such data. Period.


My take, as someone who tends to use other people's data in extended analysis, and does enjoy having the most up-to-date version of an analysis/etc. up on GitHub:

Should I ask each user if they want me to remove the datasets from their repository?

Yes. You should, fundamentally, be respectful of other people's data. Which includes things like "I'm about to put this on a website". While you haven't mentioned if your repositories are public or private, there's no guarantee that data stored in a private repo won't end up in the wild, one way or another.

Should I remove all such datasets regardless? Why or Why not?

I don't know that I'd remove all the data sets that are already up there, but I would definitely ask for approval, and if you don't hear back, assume that the answer is "No".

Is there something else I might be missing about this scenario?


These are mostly medical and health research projects.

You haven't said what kind of data, but beyond just whether or not your anonymization step is actually sufficient, is whether or not the agreements that generated this data - IRB approvals, informed consent documents, data use agreements, etc. actually allow it to be put online in this form. That is, by no means, a sure thing.

  • thanks for your +1 answer, and I'll ponder on your last paragraph. I updated the question to better reflect the context. Do you think your answer still applies with the information I added?
    – philsf
    Commented Jan 31, 2016 at 7:54
  • 6
    @philsf I do think my answer still applies - especially with students, "No one has complained" could just as easily be "This thought hasn't occurred to them" as "They're alright with it." Basically, especially with medical data, there's never a reason not to check and make sure everything is carefully checked.
    – Fomite
    Commented Jan 31, 2016 at 8:01
  • 4
    I agree with @Fomite: handling medical and health-related data are often strictly regulated, and the user/student might not even have the right to give you permission to put them online - let alone making them publically available.
    – Gerhard
    Commented Feb 2, 2016 at 16:19
  • 1
    assume that the answer is "No" — I agree if this "No" means "No, you do not have permission to upload my data set." but not if this "No" means "No, you don't have to remove it." Unless you have explicit permission, do not post other people's data.
    – JeffE
    Commented Aug 2, 2016 at 19:29

Your main reason seems to have version control in a way that is easy to share with the co-workers (as opposed to the rest of the world). This you can rather easily have without the need for publicly accessible github accounts.
I have gitlab (https://about.gitlab.com/) on an internal server (initially it was on my desktop computer) to share code and data under version control with coworkers.

would it suffice to put a warning on the repository that the dataset is not licensed the same way the code, graphs and other contents therein available?

I don't think so. Personally, I'd go for an opt-in (they need to declare explicitly that they want the data to be publicly available; and that they have the right to do this decision). The more so, if medical data is involved (see also @Fomite's answer). In my experience, anonymization isn't always as good as it is supposed to be!

Note that even private github repos are not always acceptable, e.g. EU data protection/privacy laws often do not allow sensitive data to be stored on a US server even if the access to the repo is "private" (the privacy laws here and there are not really compatible).

  • 1
    +1 for last paragraph (hoping the OP will get the idea that they're in over their head)
    – user18072
    Commented Feb 1, 2016 at 23:33

You should never post a clients data, only people that should have access to the data is if it is needed to perform their job is the rule of thumb, any examples I post I change any identifying data, if you are posting a question that uses a clients proprietary algorithm that determines something that would also violate intellectual property and you can be prosecuted.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .