Worrying about your privacy has become a regular activity for many. Everyone and everything seems to want your personal information. But why does that make you uncomfortable? And why does it change based on the situation? In this article we explore one of the most important ideas in privacy research: Privacy Concerns.
This article is based on one of the most influential papers in privacy research. In their 2011 research paper titled Information privacy research: an interdisciplinary review, Smith, Dinev and Xu propose a model for the main concepts in information privacy research. The full model talks about privacy concerns and its relation to behaviour, but we will limit ourselves to privacy concerns for now.
What are privacy concerns
To begin, we must define what privacy concerns are and why they are relevant. The story of privacy concerns starts with a common issue for abstract concepts: we can't measure the concept of privacy directly. Instead, researchers had to use a proxy variable that they could measure as a stand-in for privacy. This is where privacy concerns enter the picture.
Privacy concerns are the most used proxy in privacy research. It includes various synonyms like privacy attitudes, beliefs or perception. In the Smith et al. paper, the definition for privacy concerns is *"an individual's subjective views of fairness within the context of information privacy"*. You can think on that definition for a while, but I'll give you an informal alternative too. In a conversation, I often say that privacy concerns are how someone feels about their privacy. We can then ask people why or how much they are worried and compare their answers: we can measure it.
Privacy concerns were at first used to predict privacy behaviour. The going theory was that higher privacy concerns meant that someone was more likely to make privacy-oriented choices. That was great, because privacy concerns are a lot easier to measure than actual behaviour. Unfortunately, this theory was busted and we now call the gap between feelings and behaviour the privacy paradox. But even though privacy concerns are an unreliable predictor of behaviour, they remain very useful. Understanding why people care about their privacy helps connect us with people who have different views and may offer insight in what can be done to alleviate their worries.
Privacy concerns are most often studied in situations where individuals interact with organisations. Especially interacting with organisations through a digital medium, but in-person representatives of an organisation (e.g. a nurse or bank clerk) have been studied as well. It helps to consider that many of the influences we know of apply to this setting, and maybe less so or differently to interactions between individuals.
To sum it up, privacy concerns:
- measure a person's feelings on privacy;
- help us understand why people worry about their privacy;
- are not a reliable predictor of behaviour; and
- are most often studied in interactions between an individual and an organisation.
Influences on privacy concerns
That brings us to the variables that shape a person's privacy concerns. The model by Smith et al. names 7 factors: experiences, awareness, personality, demographic, culture, regulation and trust. They come together like shown below.
- Privacy Experiences. Our past experiences shape how we think about the future. This is no different when it comes to privacy. Research has shown that people who have been exposed to or the victim of abuses of personal data have stronger privacy concerns. As an example, being bullied online or reading about online bullying may raise concerns about the consequences of sharing personal information on the internet. It works the other way around as well. Someone who has encountered no bad experiences with sharing personal data is less likely to be concerned about their privacy.
- Privacy Awareness. Next up is knowing how an organisation handles your personal data. One way in which research has shown this is that privacy concerns are triggered when people become aware about their data being used without their permission. On the other hand, knowing that your data is being used and that an organisation does their best to protect it can lower privacy concerns.
- Personality. Not only our interaction with the environment, but the differences within people are relevant to how they feel about their privacy. Introverted people are more likely to be concerned about their privacy than extraverts. Likewise, people with a high social awareness, which is the ability to consider other perspectives, are more aware of privacy issues and developments surrounding them.
- Demographic. Differences in demographics have an effect on privacy concerns too. One study found women to be more concerned than men about their privacy. Another study in the US concluded that people with weaker privacy concerns were more likely to be young, poor, less educated and African-American. On the other hand, a 2014 study found that young people are more likely to take action to protect their privacy. Demographics make for a complex puzzle, but a relationship with privacy concerns exists for sure.
- Culture. The final one-way influence is culture. Privacy can be found in many cultural contexts with wildly different outcomes, which makes it difficult to exactly state how culture influences privacy concerns. Various findings show the influence cultural perceptions have on privacy concerns. One is the social contract about what is private and public space. Another is the level of uncertainty avoidance in the culture. A third indicator is how individualistic a society is. To present more concrete examples, one study found that Italian society has a different concept of privacy than the United States. Italians have weaker privacy concerns, but also perceived more risks in disclosing personal information. Or look at Germany, which has cultural reservations towards sharing personal information. As you can see in the image, Google Street View has significantly less coverage there than in its neighbouring countries.
The last two factors are regulation and trust. Different from the rest, these two concepts have a two-way relationship with privacy concerns. Their interplay is complex and something to elaborate on another time. What is important to know here is that trust can be built in numerous ways, for example through transparency, fair behaviour and good communication. However, having higher privacy concerns can raise the bar for trusting the other party with your personal data. And the other way around, having little trust that a business handles your data with care will increase your privacy concerns.
As for regulation, this is a reflection of the privacy concerns within a society. Strong privacy regulations can address and thus help lower privacy concerns. One example is the European Union's GDPR. By giving people certain rights, like the right to be informed, it directly addresses some of the factors in privacy concerns. Going the other way, a society that is more concerned about it's privacy is likely to adopt stronger privacy regulations.
These influences, however, do not appear out of nowhere. Some are more or less persistent on a smaller timescale, such as your demographic traits, but many are dependent on the context. To determine what influence all of these factors have, each of these variables need to be considered within the context of an interaction.
Someone may not want to share personal communications through Facebook Messenger, but will use Signal for that same purpose. Awareness of, past experiences with and trust in the two organisations all play a role in differentiating these contexts. The same goes for cultural differences between contexts. Some cultures distrust their government with their information, but happily give it to businesses to do with as they please. Others reverse this view and has individuals more wary of sharing their personal information with businesses than their government. The context in which we discuss privacy concerns plays a vital role.
Final note
While many of the examples show the influence of a single aspect, they all intertwine to determine someone's privacy concerns. A person belonging to a racial minority in the U.S.A. may worry about other things than what a business does with their data. At the same time, they can have legitimate concerns towards government data collection based on his cultural influences and past experiences with that government. And an EU citizen may trust a U.S. business that complies with the GDPR more than one that doesn't. It can make for a difficult puzzle, but knowing these concepts is a good first step in understanding why people worry about their privacy.
Primary references:
- Smith, H. J., Dinev, T., & Xu, H. (2011). Information privacy research: an interdisciplinary review. MIS quarterly, 989-1015.
- Bélanger, F., & Crossler, R. E. (2011). Privacy in the digital age: a review of information privacy research in information systems. MIS quarterly, 1017-1041.
- Malhotra, N. K., Kim, S. S., & Agarwal, J. (2004). Internet users' information privacy concerns (IUIPC): The construct, the scale, and a causal model. Information systems research, 15(4), 336-355.