Information privacy concern at individual, group, organization and societal level - a literature review

Privacy and security concern

In the CBIS, the service provider collects information about individuals and uses it for analytics (Straub and Collins, 1990). They use those resources to design and develop new products. The design of modern CBISs allows the system to pry on all the activities of an individual continuously. With communicated technologies, data can be collected, stored and reused to a significant volume (Malhotra et al., 2004). As computers, networks, mobile devices are increasing the use of communication, business process automation and other facets of life; privacy is becoming a concern of high importance. While the applications bring convenience to daily life, different agencies also collect information regarding the users, which is necessary to tailor the information to bring convenience. The data gathered about individuals might be used even without the consent of an individual. This information gathering and storage has raised two main information concerns:

1. Security concern

2. Privacy concern

Privacy concern in various domains

In this study, we have tried to analyse the interrelationship and the influencing factors affecting the privacy concern and how different applications are associated with privacy concerns. Privacy concern is of the utmost importance for applications like health-care domain, banking, governance, e-commerce, financial institutions, the internet, cloud computing, social networking and education. Privacy concern on different domain applications are as follows:

E-business

Electronic business (E-business) refers to transforming business transactions through the internet. These business transactions include a process in buying and selling, customer service, managing process on production, payment processing, collaboration with trading partners (Swani and Brown, 2011). The financial privacy (Jentzsch, 2001) is related to an individual's financial transactions are recorded with the proper process, and it ensures that all information to be covered by avoiding fraud. However, the actual required personal identifying information is collected using a certain mining software (Li and Sarkar, 2006). In social contract theory, (Donaldson and Dunfee, 1994) researcher explained the privacy concern by which the fair means of a collection of personal information on the web through online are only justified if the consumer given the preferences of control and the way of using that information. In a certain way, consumers are vulnerable towards the utility of their personal information (Culnan and Williams, 2009) and the inability to control over the information utilization.

Moreover, unknown to individual data can be collected, additional data without the individual being aware (Belanger and Hiller, 2006). Often data is shared for a particular purpose but ends up being used for an entirely different purpose. There is privacy paradox, where individual privacy information does not match actual behaviour when they are sharing information (Norberg and Horne, 2007). In some cases, individuals prefer to state their actual information through online purchase (Brown and Muchira, 2004) when they find it convenient.

Health-care domain

The health-care system is the management of the organization, consisting of resources, policies, people and services, which dealt with to deliver health-related information to the people concern. Modern health-care system activities use information technology as a baseline to deliver better and effective service to citizens (Ovengalt et al., 2017). Health-care practices cover with disease diagnosis, hospital activities and human health checkup. By the utilization of technology, it becomes easy to serve medical treatment with quality service by adopting new, developed infrastructural equipment (Raval and Jangale, 2016). The patient is in a state to provide all the necessary information to the concerned authority at the time of disease diagnosis (Tham et al., 2014). However, fear factors arise in the mind of a patient, whether private information is kept confidential. This observation creates fear and reduces trust in the hospital practitioner. Here, trust plays a major role and form a different association between patient and practitioner.

Banking and finance domain

Privacy and security concerns in banking industries tend to be a significant concern at the individual level as well as organizational level. Individuals have good faith and trust in bankers (Omariba et al., 2012) that their private data would never be made public. The banking system follows some standards which are a crucial concept to be maintained by every banker. In some cases, bankers themselves have breached the system and information has been leaked (Amor, 2002). To protect the privacy information of the customers, banks have taken major steps by formulating protection policy to accumulate the confidence of the customers (Normalini and Ramayah, 2017). Moreover, the bank also assured that, at any cost, the transaction record would not have transmitted to the public domain. Banks have committed to their privacy policies, not to disclose private and confidential information (Sohail and Al-Jabri, 2014).

Social networking

The current scenario shows that social networking has changed the way people communicate and their lifestyle. People interact with their friends, relatives and family members on a single platform, and this possibly poses a privacy risk (Alashoor et al., 2017). The hackers access detailed private information from those social network sites (Kyei-BlanksonIyer and Subramanian, 2016) by sending the adware or malicious links, and they use it to transfer all that private information. So, it becomes a significant challenge to tackle in current scenario because social media and social networking sites are heavily accessible by the youth of many nations (Spottswood and Hancock, 2017). Maintaining privacy through the social networking site is the right of the individual to show the personal information, storing the personal information, access to third parties and displaying the information via the web (Black et al., 2015).

Governance

In the recent trend of digital transformation over the internet, there are multiple opportunities available doing business and deliver excellent quality services. Nevertheless, as the information collected, processed, stored and analysed by the organizations (Singh and Chauhan, 2012), it becomes an increasing challenge towards data security, information privacy and related state of compliance. A sound governance system is one where people are working together by using three resources together – human resource, information process and technology applications. In this connection, the privacy concern of everyone to be maintained by collecting and processing the personally identifiable information (Kharade, 2016) together by keeping the trade secret with confidential information. In general, technology is an integral part of information security, threat alert and risk management (Saha et al., 2010). Employees concerned should have clearly defined roles and responsibilities, essential resources and clear guidance to handle the objectives of the organization (Martin, 2016).

The dimensions of information privacy

The privacy concern measures the degree of control by consumers (Fletcher and Peters, 1997) over the personally identifiable information. Milberg et al. (2000) explained in a study, which revealed that the privacy concern influences the attitude of individuals such as acceptance, willingness, preferences. It depends upon the individual perceptions to evaluate the correspondence of privacy concern by taking different dimensional factors (Van Slyke et al., 2006). In the process of conceptualization of IPC, Hong and Thong (2013) identified six key dimensions, and those are errors, usage, improper access, collection, control and awareness. Fear is another dimension where one is browsing details can be monitored and captured (Dinev and Hart, 2004). If there is an advancement in technology, then inappropriate accessibility of personal information could have restricted, and it will limit the inappropriate access in public domain of all stakeholders. Personal information and identity issues, with the uncertainty of user identification over the internet are gathered using the collection dimension.

Researchers have also tried to explain other dimensions by focusing on instruments like CFIP – concern for information privacy and IUIPC - Internet user’s data privacy concerns. The CFIP has focused on four dimensions includes data collection, error in data, unauthorized use of data and unauthorized access (Smith et al., 1996). At a later stage, a new version of the internet user's information privacy concerns construct has evolved and focused on three main dimensions – collection mechanism, awareness and control (Malhotra et al., 2004). The willingness of a person in a transaction varies in internet user’s information privacy concerns instrument than concern for information privacy.

Theoretical contributions

There are theoretical contributions to information privacy research using from Gregor’s (2006) designed framework concept, which classifies them into five different types – analysing, explaining, predicting, explaining and predicting and the last one is design and action (Gregor, 2006). First theory type describes the essence of information privacy, and it explains by analysing the necessity of its state. Second theory type explains details on information privacy research, and it does not contribute any expectations. Third theory type explains that it gives some concrete predictable results without developing real relationships. Fourth theory type explains both the testable results and explains the causal relationship between them. Fifth theory type explains the design and action type which specially designed tool for providing information privacy. Reagle and Cranor (1999) and Cranor et al. (2006) defined that each website has their own privacy protection protocol framework to define their own website related protection policy, and it matches with the user's privacy preferences. The tools would confirm them about their utilization of websites for the transaction, and it would assure them for safe use, and after then, this increases the behavioural trust of a consumer for the websites. Also, it could encourage consumers to measure the privacy attitude when transacting with a website.

The level of analysis in information privacy concerns

Skinner et al. (2006) identified individual, group and organizational as three levels of information privacy. After then, the article written by Smith et al. classified and described four levels of privacy as an individual, group, organizational and societal. Most of the information privacy research conducted first at individual levels, and it has implications at other levels. In the second level analysis researcher conceptualized privacy as a multilevel concept, and it has identified research effect on the phenomenon occurring at or across multilevel occurrences concurrently. In some cases, researchers look at some point of interaction between individuals and organizational approaches (Miyazaki and Krishnamurthy, 2002); Milne and Gordon (1993) gave insight on IPC at individuals as well as to the societal level of analysis. Smith (2004) and Schwaig et al. (2005) gave on organizational approaches on social culture which give an insight of multilevel approaches, and it encourages further study of the multilevel concept. The key identifiers of different literatures are listed in the appendix of our study.

Researchers addressed the IPC in the lens of multilevel concept, on how customer needs to be achieved by fair information practice (FIP). Earp et al. (2005) identified that all the privacy policies are meet the objectives of company’s viewpoint and not related from the customer’s side. Few literatures confirm that only a limited number of the population read and understand the privacy policies (Meinert et al., 2006) or people do not like or recognize privacy concern (Awad and Krishnan, 2006). To derive value from individual data and to make the balance between consumers for privacy protection and the desire for dealing business led to the design of FIP standards.

The classification of literature is based on the level of analysis and the area of research has been done so far. Table 2 summarizes (journal articles) that very limited research has been done on information privacy (IP) at different levels. Individual, group and organization are the levels of information privacy been classified and defined by Skinner et al. (2006). After then, Smith et al. (2011) uses four levels of analysis by adding a new societal level into the existing classification, and these levels are studied rigorously by following the previous research by Clark et al. (2007). In Table 2, it is found that information privacy been considered in various articles and few journal articles are found which counted more than one. Due to the availability of validated instruments, the individual level of study has been conducted sufficiently by collecting and analysing data from a huge number of individuals. Besides individual levels, we are not found sufficient literatures for other level of information privacy research. Table 2 reveals that several researches done at organizational level of study and that has been carried out in the area as information privacy practices. We have found that at the organizational level there are not much work has been done so far in IP research. With regards to e-business, organization always eager to know the impact of IP concern, which can influence a decisive achievement of the online business activity. We have found a very limited study has been done at group level IP research and researcher needs to focus more on these levels of study. Societal level is another level of approach where culture play a vital role in it. These approaches which give more in-depth information of different construct of privacy, and it varies differently in culture and various cultural values in different countries (Milberg et al., 2000). It is better to understand the information privacy of citizens in a standardized way because of the exponential growing appeal towards the corporation and government from a worldwide crowd. So, we cannot overlook the growing advent of societal effect in privacy research and researcher needs to give more attention towards the societal level of analysis. At societal level, it includes all the societal phenomenon with the group, organization and individuals in the IP level of analysis.

Individual level

The statement, right to be alone in the right to privacy, described as the right of a person to be alone by isolation from the attention of others (Warren and Brandeis, 1890). Information privacy as an option to secrecy by that everyone has the right to restrict the information about themselves in public and where outsiders should not be encouraged to take advantage of it (Posner, 1983). Privacy can be observed with autonomy (Kufer, 1987), a segment closely associated with personhood. Privacy and autonomy (Kufer, 1987), are segments closely associated with personhood. An independent self-concept explains oneself as a “purposeful, self-determining, responsible agent” and awareness of an individual to control the boundary and to control who may access and to what extent.

Personal privacy relates to each concern where it will be restricted to protect personal decorum. Information privacy is the relationship between technology and the individual’s ownership of collection and sharing of data (Smith et al., 2011). The individual's perceptions of privacy is identified using the multidimensional development theory (MDT)and develop the framework (Laufer and Wolfe, 1977). MDT focuses on the multidimensional concept – mainly environmental concept, interpersonal interactions, and self-development. France Belanger and Robert Crossler (Belanger and Crossler, 2011) explained in the first phase of the multilevel framework of I.S. research at the individual level. We have considered three areas of concern in this research, i.e.

1. Attitude

   • Information privacy attitude refers to the individual perceptions and reactions to the information policies, practices and tools and technologies. Privacy attitude includes preparedness to provide private data (Dillon et al., 2008). The main issues of privacy attitude are mentioned as each study conceptualizes the attitude differently, and some case it is focused towards privacy in general (Razzouk et al., 2008). Cao and Everard (2008) explained attitude can be used as dependent variables and in some cases, privacy attitude can be independent variables that used for preserving influence on behaviours and capability of adaptation of new technology towards information sharing's (Alge et al., 2006; Thiesse, 2007; Webster, 1998). There are some finding of the attitude toward the privacy concern is that transparent information practices to be established to organize and manage the data security, and it will be protected enough that people automatically shared information through online by the faith and trust attribute (Culnan and Armstrong, 1999).

2. Practices

   • Information privacy practice refers to organizational as well as individual actions about the protection of privacy with various interdependent factors which affect such privacy practices (Belanger and Crossler, 2011). There is some information that falsifying personal data and forcing towards deleting unwanted work attributes comes under individual privacy practice (Chen and Rea, 2004). There are some factors which affect privacy practices, include the different types of websites viewed and the originality of a site (Hsu, 2006). Sometimes, people may not know the actual practices they should follow when they are surfing on internet sites (Klasnja et al., 2009). Fair information practices (FIP) provide assessments to the policies that maintained in organizational practice. Jensen and Potts (2004) explained and some corresponding literature reveals that some companies do not give appropriate information about their privacy protection policies. In this case, consumers are not in a good mood to share their private information due to the lack of privacy protection policies. Some companies do not have such a policy when they comply with fair information practice standard (Liu and Arnett, 2002; Ryker et al., 2002).

3. Technology

   • Information privacy tools and technologies (Belanger and Crossler, 2011) research refers to the use of technological advancement on the evaluation of information privacy in a different dimension. Information privacy tools and techniques deal with privacy threats. There is research on tools and technologies which organization used to follow to abstract the privacy information of customers through the utilization of spyware and adware (Dobosz et al., 2006), to violate on consumers’ information privacy, and trust is another factor which seals organizations (Moores and Dhillon, 2003) used to protect information privacy of consumers.

Group level

In groups, the privacy information shared among the group members and outside. Researchers have found certain factors which influence group performance when it comes to privacy concerns. The factors are trust, fears, willingness and faithfulness, which influence the group dynamics behaviour among the members of the group. Information privacy on group behaviour is different from users from one group to another. In a group, when a person is trying to interact, privacy is becoming a constraint for the person (Westin, 1968). Nov and Wattal (2009) explained how an individual shows interest when trying to disclose private information in different group cultures and characteristics. Individual within a group is a core component when taken for analysis (Morgeson and Hofmann, 1999), and different groups also consisting of specific structures, constructs and identity (Watson-Manheim and Belanger, 2002). Watson-Manheim and Belanger (2007) defined that how technologies can be enhanced within groups with privacy policies to curbed the communication within the groups. Floridi (2017) defined group dynamics is the external factor concern which represents different variables like group distribution, group significance, group cohesion or group characteristics like size. Loi and Christen (2019) introduced two concepts in group privacy. They explained what confidential information shared with the group members and restrict to outside members. Furthermore, they clarified the inferential privacy where it manages the derivations that can be made about a group of individuals characterized by highlight, common by all person in a group. They contend that inferential privacy is unpersuasive to both of individual or group.

Organizational level

In the case of an organization, its policy dictates how the data is maintained. Organizational privacy (Smith et al., 1996) concern refers to the information which is confidential and not disclosed to the public. Government organizations, corporates and private societies are adopting various alternatives to maintain data confidentiality and keep data in a secret form and restricting to give access to unwanted purpose. Organizational privacy concerns mainly represented by organizational leaders. Organizational leaders have access permission to those sources of information where privacy concern of individual also linked (Belanger and Crossler, 2011). Those concerns mainly arise from management privacy practices and related policies.

Societal level

Human beings are social by nature, who cannot survive without social co-operation and other association. In a society, there are lots of online platforms available where people are engaging themselves to interact among themselves (Alashoor et al., 2017). They execute the command themselves to share their personal information either knowingly or unknowingly. However, some users are not known such type of concern at all when such information shared at the public domain in a bounded society (Spottswood and Hancock, 2017; Black et al., 2015). Researchers also find that critical dimensions like own willingness, ability, preferences and openness, which are related to privacy concern at individual levels (Belanger and Crossler, 2011). As government and corporations are appealing more on the public interface, and they should give proper attention in favour of citizen-centric culture, employees of organization and consumers about the privacy concern.

Issues/barriers in information privacy

The increase in sharing information may lead to, in some ways, breaches in privacy. The state of privacy (Hughes, 2012) defined in different types of barriers in privacy concern. They are mainly physical, behavioural and normative. Physical barriers are the touchable observation of personal assets which restrict access from others. Behavioural barriers are maintaining privacy while communicating verbally or non-verbally. Normative barriers present laws and social norms that limit a person from intruding into the private life of others. Privacy has largely one of the ethical, social and legal issues in this digital world (Culnan and Bies, 2003). Angst and Agarwal (2009) defined that due to the huge utilization of internet technology and gathering of personal information, there are new challenges come to picture and it leads to information privacy concern. Also, people expected higher government involvement concern (Dinev et al., 2006a), but a weak relation in use of e-business and privacy concern are observed (Dinev et al., 2006b). Some companies give accurate data related to privacy concerns, but some refuse to give private information to the government (Sydell, 2006). The questions arise why such distinct behaviour of two companies within the same specific country. Some cases, individuals and organizations become contradictory to each other with respect to privacy. For example, if we take e-commerce transactions where a consumer desired that his/her information is to be used only for the transactions what they opted for. But in reality, the personal information has been used by the e-commerce website without known to the consumers. In this case, consumers’ behaviour becomes unrealistic and creating a conflicting nature towards the organization and raise concern to privacy.