Is it ok to share a a client's dataset on github, along with my code?

Question

EDIT: I originally tried to make the context as brief as possible, but I may have overdone it.

Context

I'm starting to put some data analysis I'm asked to do on Github, and licensing all my work (mostly R scripts and markdown files displaying statistics, graphs and brief result descriptions). These are mostly medical and health research projects by graduate students. Faculty there usually ask for help in statistics/design and suggest their students do the same. Since I'm new, most of them are coming to me. Although I don't think it's relevant in this question, I have recently been offered a part-time position there for this exact purpose.

Reasons

The main reason for this is to provide the user student an always up to date version of the current work in progress. If something is quick to fix, say in a graph, they have an instant updated version of the current report I'm writing (usually in markdown).

I also like the transparency I offer to the researchers that ask for my help when I show the development process, what issues I have identified and the overall organization of my work.

Since most of them are not that tech-savy, I prepare the repo with plenty of README.md and other markdown files so they visualize the results and get relevant files without the need to create a github account. They usually report issues to me by email, and I open and close GH issues myself based on their feedback.

Perceived problem

It just hit me that, while my own work is my own to license the way I want, the dataset is not. I didn't participate in the collection, or curation of it. The first step I take before pushing anything to the public repository is to anonymize the dataset.

I usually show the users students the repositories of previous projects, and indicate they'll have such access to their results in a similar fashion. So far, no one has complained about their data being online. One of those projects I show is from a student of an IRB member.

Questions

• Should I ask each user if they want me to remove the datasets from their repository?
• EDIT: would it suffice to put a warning on the repository that the dataset is not licensed the same way the code, graphs and other contents therein available?
• Should I remove all such datasets regardless? Why or Why not?
• Is there something else I might be missing about this scenario?

Answer 1

Once the data is out in public, asking for it to be taken down is just theater.

Data collected by others, presumably giving the people from which it was collected explicit or implicit guarantees it was only to be used in so-and-so way, first doesn't belong to you to publish, and if it was yours, you can't publish it anyway without violating the agreement with the real owners, the people to which it applies.

I'd say you can not publish such data. Period.

Answer 2

My take, as someone who tends to use other people's data in extended analysis, and does enjoy having the most up-to-date version of an analysis/etc. up on GitHub:

Should I ask each user if they want me to remove the datasets from their repository?

Yes. You should, fundamentally, be respectful of other people's data. Which includes things like "I'm about to put this on a website". While you haven't mentioned if your repositories are public or private, there's no guarantee that data stored in a private repo won't end up in the wild, one way or another.

Should I remove all such datasets regardless? Why or Why not?

I don't know that I'd remove all the data sets that are already up there, but I would definitely ask for approval, and if you don't hear back, assume that the answer is "No".

Is there something else I might be missing about this scenario?

Yep...

These are mostly medical and health research projects.

You haven't said what kind of data, but beyond just whether or not your anonymization step is actually sufficient, is whether or not the agreements that generated this data - IRB approvals, informed consent documents, data use agreements, etc. actually allow it to be put online in this form. That is, by no means, a sure thing.

Answer 3

Your main reason seems to have version control in a way that is easy to share with the co-workers (as opposed to the rest of the world). This you can rather easily have without the need for publicly accessible github accounts.
I have gitlab (https://about.gitlab.com/) on an internal server (initially it was on my desktop computer) to share code and data under version control with coworkers.

would it suffice to put a warning on the repository that the dataset is not licensed the same way the code, graphs and other contents therein available?

I don't think so. Personally, I'd go for an opt-in (they need to declare explicitly that they want the data to be publicly available; and that they have the right to do this decision). The more so, if medical data is involved (see also @Fomite's answer). In my experience, anonymization isn't always as good as it is supposed to be!

Note that even private github repos are not always acceptable, e.g. EU data protection/privacy laws often do not allow sensitive data to be stored on a US server even if the access to the repo is "private" (the privacy laws here and there are not really compatible).

Answer 4

You should never post a clients data, only people that should have access to the data is if it is needed to perform their job is the rule of thumb, any examples I post I change any identifying data, if you are posting a question that uses a clients proprietary algorithm that determines something that would also violate intellectual property and you can be prosecuted.