Empirical Measurement of Perceived Privacy Risk

Abstract

Personal data is increasingly collected and used by companies to tailor services to users, and to make financial, employment, and health-related decisions about individuals. When personal data is inappropriately collected or misused, however, individuals may experience violations of their privacy. Historically, government regulators have relied on the concept of risk in energy, aviation and medicine, among other domains, to determine the extent to which products and services may harm the public. To address privacy concerns in government-controlled information technology, government agencies are advocating to adapt similar risk management frameworks to privacy. Despite the recent shift toward a risk-managed approach for privacy, to our knowledge, there are no empirical methods to determine which personal data are most at-risk and which contextual factors increase or decrease that risk. To this end, we introduce an empirical framework in this article that consists of factorial vignette surveys that can be used to measure the effect of different factors and their levels on privacy risk. We report a series of experiments to measure perceived privacy risk using the proposed framework, which are based on expressed preferences, and which we define as an individual's willingness to share their personal data with others given the likelihood of a potential privacy harm. These experiments control for one or more of the six factors affecting an individual's willingness to share their information: data type, computer type, data purpose, privacy harm, harm likelihood, and individual demographic factors, such as age range, gender, education level, ethnicity, and household income. To measure likelihood, we introduce and evaluate a new likelihood scale based on construal level theory in psychology. The scale frames individual attitudes about risk likelihood based on social and physical distance to the privacy harm. The findings include predictions about the extent to which the above factors correspond to risk acceptance, including that perceived risk is lower for induced disclosure harms when compared to surveillance and insecurity harms as defined in Solove's Taxonomy of Privacy. We also found that participants are more willing to share their information when they perceive the benefits of sharing. In addition, we found that likelihood was not a multiplicative factor in computing privacy risk perception, which challenges conventional theories of privacy risk in the privacy and security community.

Health Information Systems in the Digital Health Ecosystem—Problems and Solutions for Ethics, Trust and Privacy

“…This raises the pressure to understand privacy as a public good or a commodity [17]. It might also be possible in the next decades that privacy is not considered anymore as a personal right, but understood as a statistical risk [43,86], probability [87] or commodity. Furthermore, there is at least a tendency towards understanding the sharing of PHI as societal obligation.…”

“…The nature of Digital Health Ecosystem in general make measuring and estimating the level of privacy risk difficult or even impossible for the DS or patient. Furthermore, there are no empirical methods for a DS to determine which PHI in a situation is at-risk, what is the level of risk in a specific context and the likelihood of harm [43]. This has led to the increasing use of the concept of perceived privacy risk that can be estimated for example by surveys, use-cases and expert evaluations.…”

Futures for Health Research Data Platforms From the Participants’ Perspectives

“…Each card contained a different 'information item' (see Table 2). The choice of items was based on the analysis of previous works about data sensitivity and willingness to share [12,14,37,47,61,83,86,121,123,141,146], data collected in the different platforms, and mobile sensing frameworks for behavioural monitoring [23]. Three medical doctors were consulted to confirm that the card set contained only data relevant to health research.…”

“…Individuals may start to collect data for themselves but agree to share it for research afterwards. For instance, Achievement [2] is a commercial mobile app for personal health Acceptance and Trust People trust some institutions more than others [34,39,118,132] Trust can be hindered by previous experiences [3,5,34] Acceptance decreases if data collection is hard [32,71] Acceptance decreases if the purpose is not useful [75,78,137,152] Willingness to share People worry about data misuse [78,95,96] People want to preserve their reputation [65,77,111,119,121] Some types of data are more sensitive [14,47,61,86,123,146] Some people are more concerned than others [8,63,86] Consent and Ethics Consent forms are lengthy and complex [84,110] People cannot understand the risks [31,94,115,131] Lack of flexible sharing options and control [5,27,57,64,73,91,106] Lack of transparenc...…”

“…Some factors can affect the intensity of privacy concerns. Previous research has found that more sensitive data types are disclosed less often [86,123], such as audio recordings [37], browser history [14], message/phone logs and social media activity [47], camera pictures [121], financial information [146], home address [83], feelings of loneliness [61], sexually transmitted diseases [146], toilet use [12], and any health-related data in general [141]. Privacy is also perceived differently across individuals [22].…”