[fastaguy88]

>IRBs are only REALLY required when you are intervening in patient care or pose some theoretical risk to a human.

Theoretical risk is a very broad category. IRB approval is required to download de-identified human genome sequences, in part because the genome sequence can be used to identify the individual. Drawing blood from an individual, or using blood that has been drawn for other purposes, requires IRB approval. And IRB approval is required for many sociology studies (or surveys), in part because publishing an individuals answers to a survey might put the subject at risk.

So the "theoretical risk" threshold can be very low. It's theoretical after all, so the harm need only be imaginable.