efrim boritz won gyun no r. p. sundarraj the effect of involvement and privacy policy disclosure on...
TRANSCRIPT
EFRIM BORITZWON GYUN NO
R. P. SUNDARRAJ
The Effect of Involvement and Privacy Policy Disclosure
on Individuals’ Privacy Behaviour
DISCUSSANT COMMENTSJames E. Hunton, Bentley
Purpose
The purpose of this paper is to examine the extent to which an internet vendor’s privacy policy disclosures can affect an individual’s propensity to provide personal information over the internet, depending on the perceived sensitivity of such information.
Motivation
The general issue of information privacy is certainly relevant given the increasingly digitized world in which we live.
The misuse of such information, as with identify theft, can harm affected individuals in myriad ways.
Overall Observation
The paper is very confusing to read—often jumping back and forth in a way that makes it very difficult to understand.
One of the first points of confusion was the authors’ meaning of the term ‘level of involvement with privacy’.
Overall Observation
The authors (finally) defined ‘involvement’ as “…an unobservable state of motivation, arousal or interest” (Rothschild 1984).
They then use the Elaboration Likelihood Model (Petty and Cacioppo 1986) as the primary theory
Elaboration Likelihood Model
Central Cues--Diagnostic--
Merits of persuasive arguments
Peripheral Cues
--Non-Diagnostic--
Heuristics Biases
According to Petty et al. (1987) the term elaboration refers to an individual’s motivationto exert considerablecognitive effort towardevaluating issue-relevant information
Current Construct Map
Motivation Motivationto exert effort Leads To to exert effort
Privacy
Involvement
Privacy
Disclosure
Elaboration
+
Risk and Trust
Rather than ELM, combine two theories: Multidimensional Development Theory of Privacy Theory of Planned Behavior
Perceived
Information
Risk
Trust in
Information
Use and Security
Search for
Risk-Reducing
Information
Provision of
Sensitive
Personal
Information
+ + +
Belief Behavior Attitude Behavior
Internal Validity
The research method was rather complex and confusing.
First, participants were randomly assigned to one of the six experimental treatments.
Then, participants completed a web-based survey.
Based on their answers to certain questions, subsequent survey items were altered.
Specific privacy information to be used in the high and low privacy involvement (information risk) treatments was established.
Internal Validity
For example, if a participant was randomized into the high information risk treatment, and identified SIN and SID as the two most sensitive pieces of private information, these two pieces appeared in subsequent survey questions and were used to operationalize the high risk treatment in the post-survey experiment
Demand Effects
Consider a participant who just said that SIN and SID were the two most sensitive pieces of personal information, and then were presented with a ‘mock’ website (see Figure 3a): How likely would you be to complete this form when SIN
and SID are requested? If the web site had a privacy policy statement, how likely
would you be to complete this form when SIN and SID are requested?
If the web site had a privacy policy statement and a privacy seal {e.g., TRUSTe} how likely would you be to complete this form when SIN and SID are requested?
Demand Effects
The cat is out of the bag; meaning, the participants likely know that the experimenter wants to study which can affect how they will respond when asked for, what they deem to be, sensitive personal information.
Further, the participants are now primed about the upcoming privacy disclosure treatment used in the experiment, as they are asked on the same form (Figure 3a) to identify the two most and least important privacy practices.
Suggestions for Improvement
The construct of ‘Trust’ was not explicitly measured, so the researchers would have to reason that increased trust is implied by the willingness to provide sensitive personal information.
Perceived
Information
Risk
Provision of
Sensitive
Personal
Information
Search for
Risk-Reducing
Information
Link 1 Link 2
Suggestions for Improvement
Collapse the experimental design.
Perceived Information Risk
Low High
Privacy No
Policy
Disclosure Yes
Suggestions for Improvement
H1: Individuals who perceive relatively high private information risk will be more motivated to read a company’s privacy policy disclosure than individuals who perceive relatively low private information risk.
Perceived
Information
Risk
Provision of
Sensitive
Personal
Information
Search for
Risk-Reducing
Information
Link 1 Link 2
Suggestions for Improvement
H2: When individuals perceive relatively high private information risk, they will be more likely to provide sensitive information to a web-based company that discloses its privacy policy, as compared to a company that does not disclose its privacy policy.
Perceived
Information
Risk
Provision of
Sensitive
Personal
Information
Search for
Risk-Reducing
Information
Link 1 Link 2
Suggestions for Improvement
H3: When individuals perceive relatively high private information risk and read the web-based company’s privacy policy, there will be a positive relationship between the time they spend reading the policy and the provision of sensitive information.
Perceived
Information
Risk
Provision of
Sensitive
Personal
Information
Search for
Risk-Reducing
Information
Link 1 Link 2
Suggestions for Improvement
If a person spends more time reading the disclosures, one could reason that he/she is more likely to notice the omission of the two most important privacy practices; therefore, he/she will be less likely to provide the personal information than one who spent less time reading the disclosure
Perceived
Information
Risk
Provision of
Sensitive
Personal
Information
Search for
Risk-Reducing
Information
Link 1 Link 2
H3
Suggestions for Improvement
The experiment is interesting because it tracks actual behaviour, but it is threatened by potential demand effects; thus readers should be cautious in drawing inferences from the experimental findings.
The ‘take away’ from this study is that before individuals provide, what they deem to be, sensitive personal information over the internet, they need to trust that the organization will properly use and secure the information.
This ‘need for trust’ suggests that companies should be transparent about their privacy policy practices, thereby providing customers with sufficient and necessary information to make an informed decision.
