This paper examines the view of the operational management of the UK Research Ethics Committee (REC) system that RECs may not reject applications on purely legal grounds. Two arguments are offered for this view: the first rests on the contention that being lawful and being ethical are not the same thing; the second is that RECs lack expertise and authority to base their decisions on legal considerations. However, whatever the philosophical standing of the first argument, it is contrary to published guidance, the basis of RECs' official authority, unethical, and politically imprudent to permit RECs not to consider conformity with the law to be at least a necessary condition for REC approval. In any event, RECs can obtain competent and authoritative advice on the law (though the Department of Health has been remiss in this regard), and they do not exceed their authority by applying the law, because this is within their ethical remit. When current guidance to RECs about advising researchers on whether or not breaches of confidence are permissible in the public interest is linked to the view of the REC management that the role of RECs is to facilitate research (albeit ethical research), this raises serious doubts about the integrity of the system of ethical review currently in place, which is illustrated by a recent "agreement" of the Chairmen of the MRECs not to consider the Data Protection Act 1998 in their ethical review.