Possible retraction for using data from a M.S. thesis given to me by the student

Question

I recently published a paper that used data that was given to me (willingly) by a recently graduated M.S. student. This student already published their thesis and had decided to leave academia. I re-did the analysis, cited the thesis, and included the student in the acknowledgements. The work was done internationally, and the student obtained external funding (granted to them) to collect the data and obtained a research permit to do the work.

I have recently been made aware that the students former supervisors have requested a retraction of the paper on the grounds that the student did not own the data and was not entitled to share with me. It is my understanding that the former supervisors are requesting retraction of the paper so that they can publish on the same topic. To make things even more complicated, the student should have shared the data with their international collaborator and they did not, and this is the angle they are pushing with the journal. Although it has been made clear that nothing can be done about this, a big part of the reason the student left academia was due to bullying by one of the previous supervisors. I have a few questions that I would love input on:

1. Was the student entitled to share the data, considering they obtained the funding, the research permit is in their name and they already published their thesis?

2. Is a thesis considered a published work in the sense that we could use the data given to us and cite the thesis?

3. In the case our paper is retracted, will the ex-supervisors be able to publish without the consent of the student?

I am a ECR and the idea of having to retract a paper is highly troubling, especially considering there was no intentional wrong-doing on the part of myself or the student.

EDIT: I didn't want to share too many specific details, but the grant was from the Fulbright to the student.

Answer 1

(1) can only be answered if we were to know the exact nature of the agreement that the student entered with the grant givers. Usually, there is no explicit assignment of ownership, but only an informal understanding of future collaboration.

(2) However, a thesis is usually public, so (unless there was a temporary embargo as allowed by some institutions on request by the submitter,) the thesis and the data has already been published before you took up your work. Therefore, the "breach of confidentiality" constituted by the publication of the data had already happened before you published the paper. You might want to ensure that your institution (the one where the thesis was done) agrees with me on the public nature of a thesis.

However, the journal might still want to retract the paper because they might be afraid of a lawsuit, which in turn might open them up to a lawsuit by you.

(3) If the ex-supervisors then publish the "same" paper, they open themselves up to accusations of plagiarism as their analysis needs to be sufficiently different from yours. If however their analysis is sufficiently different from yours, they are fine, as we have to consider the data to be in the public domain.

From your narrative, it is a bit unclear what the student did (maliciously or unintentionally setting you up to publish the student's data that the student was not free to publish or acting in complete innocence doing what the original grant asked the student to do) and to what extent the student is the victim. However, legally, it seems that you have to "throw the student to the wolves" as the right of the student to publish the data in the student's thesis is at issue here.

Now, if the data was not public, and you relied on the permission of the student to give you what was not the student's to give, you might definitely enter lawyer territory.

Under all circumstances, go and talk to your supervisor / dean in order to get access to the legal resources of your institution. From your narrative, it is clear that you acted in good faith and with sufficient prudence. As your affiliated institution on the paper, they are interested in protecting their name. As your employer, they might want to know about possible legal exposure.