Answer review using this scenario

Scenario:

Andre is a scientist on a medical research team studying the role of genetic factors in psychological disorders. The teams research is focused on how different variants influence social behavior. To facilitate this work, Andre built a tool that link three anonymized data sets: an anonymized set of genetic test results accessible only by medical researchers, a publicly available anonymized database of clinical diagnoses, and a custom database of public social networking posts. To preserve anonymity, the tool substituted all personally identifiable information in the social networking posts with quasi-identifiers. Andres team was granted approval for a study by their ethics review board (ERB), under the condition that all data was anonymous and/or public, and all users had opted in to the data collection.

In the process of testing the tool, Andre found a bug that incorrectly linked some records to multiple individuals as a single person. Since the data sets were all anonymized, the team had accepted that such erroneous matches could possibly occur. The bug increased the expected number of matches, but to only a small extent; as a result, the bug was classified as a low priority. Andre raised concerns that there could possibly be other bugs and suggested the source code be released under an open source license to facilitate peer review of both the tool and the overall research.

Review: What responsibilities, authority, practices, or policies shaped the actors choices? What potential actions could have changed the outcomes?