Recently, the Brown IRB has been sued by a faculty member because the IRB prohibited her from using the data collected without IRB approval (click for article). The case is complicated and has stimulated considerable discussion on the IRB Forum. Aside from the specifics of this case, a more general concern is the authority of the IRB to determine whether data gathered without IRB approval can be published or used for research. The regulations are silent on this matter and do not directly give the IRB the authority to make this determination. We have long advised that institutions should not base their human research protections policies merely on complying with regulations and have advised our clients to have an institutional policy establishing the authority of the HRPP and the IRB. Institutional policy should indicate what person or body has the authority to make determinations regarding the use of data collected without IRB approval. We recommend that it be the IRB that makes this determination, but that is up to the institution.