When respondents give information about "other people" who are not directly interviewed these "others" are known as "third parties".
The Common Rule applies to any person who has the potential to be harmed because of a research project, whether or not the person is directly interviewed or identified through an interview with someone else.
The research project will be assessed by the IRB for the likelihood of third parties potentially being harmed. The IRB will determine what type of oversight is required based on level of potential risk.
The project information should be kept confidential; the level of confidentiality (applicable to all identified persons, not just interviewed subjects in the research) should be commensurate with the level of risk.
The regulations do not automatically mandate informed consent from third parties. If the potential risk is serious and not ameliorated by confidentiality procedures, then consent may be necessary.