The influence of the informal social learning environment on information privacy policy compliance efficacy and intention

Abstract

Throughout the world, sensitive personal information is now protected by regulatory requirements that have translated into significant new compliance oversight responsibilities for IT managers who have a legal mandate to ensure that individual employees are adequately prepared and motivated to observe policies and procedures designed to ensure compliance. This research project investigates the antecedents of information privacy policy compliance efficacy by individuals. Using Health Insurance Portability and Accountability Act compliance within the healthcare industry as a practical proxy for general organizational privacy policy compliance, the results of this survey of 234 healthcare professionals indicate that certain social conditions within the organizational setting (referred to as external cues and comprising situational support, verbal persuasion, and vicarious experience) contribute to an informal learning process. This process is distinct from the formal compliance training procedures and is shown to influence employee perceptions of efficacy to engage in compliance activities, which contributes to behavioural intention to comply with information privacy policies. Implications for managers and researchers are discussed.

Information security knowledge sharing in organizations: Investigating the effect of behavioral information security governance and national culture

“…Puhakainen and Siponen (2010), however, criticized information security approaches as lacking not only theoretically grounded methods, but also empirical evidence on their effectiveness. As a possible consequence of this critique, the recent years have witnessed an increase in investigations that meet these criteria, and have based their analyses on a variety of theories including theory of planned behavior (Bulgurcu et al, 2010), neutralization theory (Siponen and Vance, 2010), learning theory (Warkentin et al, 2011), organizational narcissism (Cox, 2012), and protection motivation theory (Ifinedo, 2012). A dominant part of the studies have focused on the first category (Warkentin and Willison, 2009) -that is, the "individual" level of information security by either testing theories that explain an individual"s compliance/non-compliance to information security policies (e.g., Ifinedo, 2012) or how perceptions of different information security countermeasures such as education and awareness training might lead to a decrease in information system abuse or misuse (e.g., D"Arcy, Hovav, and Galletta, 2008).…”

The Mobile Privacy-Security Knowledge Gap Model: Understanding Behaviors

“…36,37,50,51,52]. In the information privacy literature, self-efficacy has not been as regularly included but has been shown to influence intentions to follow a privacy policy [70] and to protect oneself on the Internet [71].…”

“…While the IMB Skills model suggests that both perceived an actual abilities are necessary to enact a preventive behavior (Figure 2), most prior research on information security and privacy has focused mostly on measuring self-efficacy (a perceived ability) to evaluate knowledge [e.g., 37,70,72,73]. Self-efficacy deals with one's perceived confidence at performing a behavior, such as utilizing a technology.…”

The Information and Communication Technology User Role: Implications for the Work Role and Inter-Role Spillover

“…Individuals vary in the extent to which ICTs are important to them (Limayem et al, 2007), the extent to which they want to interact with ICTs (Compeau and Higgins, 1995), and their interest in engaging with ICTs in new and different ways (Agarwal and Prasad, 1998), all of which would suggest that individuals might attribute varying levels of importance and centrality to their ICTU role identity (e.g., Gefen and Ridings, 2003; Turel et al, 2011a). This literature further implies that interpersonal differences in ICTU identity can be rooted in individual differences in innovativeness (Yi et al, 2006), computer self-efficacy (Marakas et al, 2007), beliefs and perceptions regarding technologies (Venkatesh, 2000), social pressures to use technologies (Titah and Barki, 2009), impression management (Turel et al, 2010), and adherence to ICT related policies (Warkentin et al, 2011). …”