Fair Information Practices Research Articles

The effects of fair information practices on ad effectiveness among Chinese consumers: trust transfer across contexts

ABSTRACT In response to growing privacy concern among global online consumers, platform companies may follow principles of fair information practices (FIPs) to foster consumer trust, which subsequently shapes the effectiveness of digital ads displayed by the platform. However, the connection between FIPs and advertising perceptions remains underresearched in existing literature. By establishing and testing a dual context framework that integrates theories of procedural fairness, trust transfer and regulatory focus, this study investigates the psychological mechanism driving the effects of FIPs on targeted ads. The results show that FIPs arouse consumers’ platform trust via perceived fairness, followed by a transference of trust from the platform to the ads, thereby amplifying positive responses to targeted ads. Whereas privacy concern is reduced by platform trust, its hypothesised effects on ad effectiveness were not supported. Our findings underscore a cross-context trust transference embedded in social platforms for advertising, whereby trust enhancement (relative to privacy concern reduction) directly boosts ad perceptions, thus, offering valuable insights on the practices of digital platform managers and e-marketers.

Privacy Harm and Non-Compliance from a Legal Perspective

In today's data-sharing paradigm, personal data has become a valuable resource that intensifies the risk of unauthorized access and data breach. Increased data mining techniques used to analyze big data have posed significant risks to data security and privacy. Consequently, data breaches are a significant threat to individual privacy. Privacy is a multifaceted concept covering many areas, including the right to access, erasure, and rectify personal data. This paper explores the legal aspects of privacy harm and how they transform into legal action. Privacy harm is the negative impact to an individual as a result of the unauthorized release, gathering, distillation, or expropriation of personal information. Privacy Enhancing Technologies (PETs) emerged as a solution to address data privacy issues and minimize the risk of privacy harm. It is essential to implement privacy enhancement mechanisms to protect Personally Identifiable Information (PII) from unlawful use or access. FIPPs (Fair Information Practice Principles), based on the 1973 Code of Fair Information Practice (CFIP), and the Organization for Economic Cooperation and Development (OECD), are a collection of widely accepted, influential US codes that agencies use when evaluating information systems, processes, programs, and activities affecting individual privacy. Regulatory compliance places a responsibility on organizations to follow best practices to ensure the protection of individual data privacy rights. This paper will focus on FIPPs, relevance to US state privacy laws, their influence on OECD, and reference to the EU General Data Processing Regulation. (GDPR).

Open Government Data Programs and Information Privacy Concerns: A Literature Review

This study presents a narrative review of the literature on privacy concerns of Open Government Data (OGD) programs and identifies suggested technical, procedural, and legal remedies. Peer-reviewed articles were identified and analysed from major bibliographic databases, including Web of Science, Digital ACM Library, IEEE Explore Digital Library, and Science Direct. Included articles focus on identifying individual information privacy concerns from the viewpoint of OGD stakeholders or providing solutions for mitigating concerns and risks. Papers that discussed and focused on general privacy issues or privacy concerns of open data in general or open science privacy concerns were excluded. Three streams of research were identified: 1) exploring privacy concerns and balance with OGD value propositions, 2) proposing solutions for mitigating privacy concerns, and 3) developing risk-based frameworks for the OGD program at different governmental levels. Findings suggest that contradictions with Fair Information Practices, reidentification risks, conflicts with OGD value propositions, and smart city data practices are significant privacy concerns in the literature. Proposed solutions include technical, legal, and procedural measures to mitigate privacy concerns. Building on the findings, practical implications and suggested future research directions are provided.

A Design Theory for Transparency of Information Privacy Practices

Public policy initiatives demand transparency of information privacy practices (TIPP) since the 1970s, at least, when a first version of the fair information practice principles (FIPP) was published. Decades later, information system (IS) providers are still struggling to meet this demand. Apparently, there is a tension between socially desirable guardrails for privacy practices (e.g., allowing for anonymity) and economic value creation (e.g., exploiting personalization surplus). To inform IS designs that can change such avaricious states to the benefit of consumers, we present a theoretical foundation (TIPP theory) explaining and prescribing what needs to be built to establish TIPP in the real world. On the one hand, TIPP theory explains why IS providers, who have privacy practices to hide, should not go beyond IS designs that meet legal demands. More importantly, TIPP theory explains and prescribes what IS providers need to build to actually establish TIPP and be able to differentiate from competitors by doing so. TIPP theory will be useful for all involved parties: IS providers are enabled to avoid privacy notice fallacies, public policy makers can give more details in their related guidance and laws published, and consumers can, ultimately, interact with IS that actually establish TIPP.

Protecting the Unprotected Consumer Data in Internet of Things: Current Scenario of Data Governance in Malaysia

With the increasing number of smart devices and connections in Internet of Things (IoT) comes risks—specifically involving consumer data protection. In this respect, this exploratory research examines the current issues of IoT and personal data protection in Malaysia that includes: regulatory frameworks and data governance; issues and gaps; and key challenges in implementation. Results from this mixed-methods research indicates that a majority of consumers expressed concern about personal data risks due to increased usage of IoT devices. Moreover, there is a crucial need to increase regulation and accountability in the industry. In this regard, collaboration and partnerships between the main stakeholders are essential in tackling emerging issues of IoT and personal data protection. In order to strengthen IoT data governance, the fundamentals should be: strengthening consumer education and smart partnership between government-industry-civil society; providing motivation for active participation of NGOs and civil society; and obtaining industry buy-in. This paper also proposes a structure for the governance of evolving data-related technology, particularly in the case of data breaches or cyber incidents. It adds to the wider discussion of the current scenario, and proposes a model of collective responsibility in IoT data governance that is underpinned by the three principles of fair information practices, privacy impact assessment and privacy accountability.

Privacy in the sharing economy: Why don't users disclose their negative experiences?

A consistent positivity bias has been found in many sharing economy platforms. Extreme positivity bias in reviews makes the review system meaningless, misleads the public, deteriorates users' trust in the sharing platform, and negatively influences consumers' participation on the platform. Considerable anecdotal evidence shows that privacy concerns are a barrier to providing honest negative reviews. However, research studies on the consumers' impact of privacy concerns on review behaviors are sparse. This study aims to fill the gap by investigating consumers' privacy concerns in writing negative reviews. Specifically, this study examines the effects of two types of privacy concerns, online privacy concerns and physical privacy concerns, on the intention to provide negative reviews and contingent factors (monetary incentive, venting negative feelings, and warning other consumers) that could influence this relationship. The study also examines the effectiveness of two fair information practices (i.e., privacy policy and anonymous feature) in mitigating privacy concerns. We evaluate our research model using a scenario-based online survey, providing broad support for our hypotheses. The study delineates the implications of the results for both practice and research.

Online Privacy Policy Disclosure: An Empirical Investigation

ABSTRACT While companies’ privacy policies inform consumers about their privacy practices, their adherence to regulations and Fair Information Practices (FIP) may vary widely. We develop and apply an extended checklist to examine the privacy practices of companies with a higher privacy and data security risk. We find that industry sector has a significant effect on companies’ privacy practice. Specifically, companies in the non-regulated communication services sector complied to FIP better than those in the regulated financial sector, indicating that the FTC’ self-regulation approach works, at least for the examined sector. While 67% of companies fully complied to the Security principle, they were not doing enough in full specification of Enforcement in their privacy policies, indicating that regulators need to strengthen enforcement provision in regulations and develop and enlist various enforcement mechanisms. Overall, this research informs legislation and the public on the effectiveness of self-regulation and government regulation.

An Exploration Into Trust and Privacy Management in a Digital Age

This study aims to inspect the effects of the privacy management and realize the relationship between use of trust and the quality of the privacy policy for the sites. This research applied four criteria of notice, access, choice and security that were identified by the FTC as Fair Information Practice to assess 476 websites for the trust and privacy management. Results indicated that approximately 36% of the websites used a trustmark, and that HiTrust/VeriSign was the most commonly used by businesses. The preferred trustmark varied by industry, such as sports sites preferring Verified by VISA, real estate sites preferring SOSA, telecommunication sites preferring HiTrust/VeriSign, and travel sites preferring TWCA. However, BBB Online and TRUSTe were displayed very hardly. The main findings showed that there were no obvious relationships between the use of trust marks and the notice criterion. On the contrary, there were very strong relationships between the use of trust marks and the access and choice criteria for all industries and overall.

How to protect privacy in a datafied society? A presentation of multiple legal and conceptual approaches

The United Nations confirmed that privacy remains a human right in the digital age, but our daily digital experiences and seemingly ever-increasing amounts of data suggest that privacy is a mundane, distributed and technologically mediated concept. This article explores privacy by mapping out different legal and conceptual approaches to privacy protection in the context of datafication. It provides an essential starting point to explore the entwinement of technological, ethical and regulatory dynamics. It clarifies why each of the presented approaches emphasises particular aspects and analyses the tensions that arise. The resulting overview provides insight into the main strengths and limitations of the different approaches arising from specific traditions. This analytic overview therefore serves as a key resource to analyse the usefulness of the approaches in the context of the increasing datafication of both private and public spheres.Specifically, we contrast the approach focusing on data subjects whose data are being ‘protected’ with others, including Fair Information Practice Principles, the German right to ‘informational self-determination’, and the South American ‘habeas data’ doctrine. We also present and contrast emerging approaches to privacy (differential privacy, contextual integrity, group privacy) and discuss their intersection with datafication. In conclusion, we put forth that rather than aiming for one single solution that works worldwide and across all situations, it is essential to identify synergies and stumbling blocks between the various regulatory settings and newly emerging approaches.

Big Data Analytics in IRS Audit Procedures and Its Effects on Tax Compliance: A Moderated Mediation Analysis

ABSTRACTBig Data analytics could be a panacea for the IRS by enabling creation of taxpayer profiles to better capture noncompliance using artificial intelligence and machine learning, requiring fewer costly manpower hours. Privacy, fair information practices, and embedded biases are critiques of such practices, and it is unknown how taxpayers will respond. Deterrence theory suggests improved audit effectiveness will increase compliance but excludes elements of tax morale, including perceived fairness. We find evidence supporting a moderated mediation model where procedural fairness mediates the relationship between audit procedures and tax compliance, moderated by participatory monitoring, which captures how effects vary when taxpayers willingly increase traceability of their income by advertising online. When taxpayers advertise business online, use of advanced technologies in audit selection significantly increases compliance with no significant effect on perceived fairness; when they do not, use of advanced technologies has no effect on compliance, but significantly decreases perceived fairness.

Information Privacy, Cultural Values, and Regulatory Preferences

The global nature of e-commerce is complicating privacy issues because perceptions of privacy, trust, risk, and fair information practices vary across cultures, and differences in national regulation create challenges for global information management strategies. Despite the spike in international regulatory attention devoted to privacy issues and the tensions associated with them, there has been very little research on the relationship between information privacy concerns and consumers' regulatory preferences, and even rarer is research that incorporates cultural values into a framework that includes privacy concerns and regulation. This study examines privacy concerns, a full complement of cultural values, trust, risk, and regulation at the individual level in a cohesive manner. Relying on a dataset of consumers gathered in the United States and India, the authors test a model that incorporates these constructs as well as trust and risk beliefs. The model explains 48% of the variance in consumers' regulatory preferences, and all but one of the hypotheses find statistical support.

Data privacy and residential smart meters: Comparative analysis and harmonization potential

Building on privacy principles of the Fair Information Practice Principles and the European Union's General Data Protection Regulation, the study compares national policies and programs in Europe and North America and identifies prevailing practices for implementing privacy goals for residential energy customers: customer opt-out policies, sampling and sharing guidelines, independent data storage, and governmental enforcement authority. The analysis provides the basis for privacy standards that could apply to advanced-metering customer data across countries, even with rapidly evolving technology.

Little Things and Big Challenges: Information Privacy and the Internet of Things

IntroductionThe of (IoT) is part of our lives in countless ways- some are welcome and intentional, such as trackable fitness devices, home security alert systems, or cars that can be unlocked and started remotely; others are unintentional and may cause concern to consumers, such as connected toys that can listen to our kids, or technologies capable of tracking our whereabouts or our shopping habits without our knowledge. The rapid growth of IoT has prompted incredible technological advances along with thorny regulatory issues, specifically in area of information privacy. Traditional regulators of privacy, specifically Federal Trade Commission (FTC), have stretched to apply traditional tools to regulate unprecedented technological advances and privacy challenges they bring. An analysis of latest FTC cases and outcomes reveals an independent agency retooling investigative and enforcement methods and priorities to establish new expectations for how fair information practices and principles will be applied to new technologies.The FTC, like technological advances it has stretched to keep pace with, has been increasingly progressive in its recent decision-making terminology. This Article uses recent, seminal FTC cases and outcomes to demonstrate how FTC has developed new information privacy framework, most recently expressed as concept of unfair tracking, by modifying traditional legal concepts. The FTC has significantly expanded its role as primary reviewer of information privacy matters raised by IoT, while attempting to balance philosophy not to impede advance of technology comprising IoT. This Article reviews recent FTC efforts to regulate IoT and provides critical commentary on how FTc might proceed.To best understand genesis of recent FTC actions on IoT data collection, Part i describes what makes up ioT, how pervasive ioT has become in our lives and, perhaps most importantly, how it will continue to innovate at rapid pace. Parts II and III of this Article describe some unprecedented benefits and unprecedented challenges confronting regulators of information privacy in today's IoT age, including how to protect individual privacy rights without undermining innovation and promise connected world of IoT brings.Part IV provides an in-depth critical review of four key FTC cases attempting to strike this sort of balance: In re Nomi Technologies, Inc.,1 United States v. InMobi Pte Ltd..,2 In re Turn, Inc.,5 and FTC v. VlZIOi Initially, FTC applied its traditional section 5 deception jurisprudence in novel way to advance traditional notions of privacy, but it has recently transitioned to new paradigm in form of cause of action for unfair tracking, starting with VIZIO. However, this Article concludes that this new standard could prove either too anemic or, alternatively, overbroad, without proper shepherding by FTC. It is only with proactive guidance to supplement its traditional reactive enforcement that little things of IoT can overcome big information privacy challenges IoT creates.I. IoT: A Big Connection of Little ThingsThe term Internet of Things (IoT) has been defined in variety of ways. In broadest sense, phrase encompasses everything connected to [I]nternet, but it is increasingly being used to define objects that 'talk' to each other.5 A simple definition of IoT is the concept of basically connecting any device with an on and off switch to (and/or to each other).6 Oxford Dictionaries define it as [t] he interconnection via of computing devices embedded in everyday objects, enabling them to send and receive data.7 Others define IoT as the ability of one device to connect to other devices through wireless data infrastructure8 or a system of devices and things that are implanted with sensors, software and electronics to initiate exchange and collection of data and information. …

The effect of Fair information practices and data collection methods on privacy-related behaviors: A study of Mobile apps

To capitalize on valuable consumer and transactional data on mobile apps, companies should employ ethical decisions and strategies that can reduce privacy concerns, because such concerns present critical challenges for corporate social responsibility. In this study, we tested the effect of intervention strategies, Fair Information Practices, and the data collection method on privacy-related decisions. The results show that both intervention strategies have a significant effect on perceived data control and perceived risks and in turn on behavioral intention. Our findings have novel theoretical and managerial implications to those who want to promote ethical business practices in the mobile apps industry.

Review of literature for health information security on Sri Lankan health

Introduction: A large number of government health institutions in Sri Lanka are using Health Information Systems at present. However, there is no national-level health information security policy or privacy protection legislation in the country to regulate health information security and privacy. The objective of this study was to identify the current policies and acts related to health information security and privacy in Sri Lanka. Methods: A literature search was carried out in PubMed and google scholar databases. Grey literature is also included in the search, such as Health Ministry publications. Following keywords/ search terms were used: Information Security Policy in Sri Lanka, Information Security Act in Sri Lanka, Health Information Security, Health Data privacy. Results: There were no specific documents on health information security and privacy in Sri Lankan context. However, nine documents published by the ministry of health were related to health information. Except for the National Policy on health information, other documents have limited description on security-related areas such as data storage, information disclosure, patient privacy and patient consent. Data/Information Security, Client Privacy, Confidentiality and ethics were addressed with few strategies including fair information practices, Anonymity and Pseudo anonymity and empowering health care recipients in The National Policy on Health information. In addition, there are some general e-laws and policies related to electronic data which can be partially linked to information management in the health sector. Conclusions: Most of the available documents only briefly address security and privacy issues. However, when a legal value has been given to electronic information systems, it helps to restrict information misuse and promotes authorized use of personal health data. As there is no specific policy or acts to safeguard health information security and privacy there is an urgent requirement to develop policy documents and guidelines addressing issues like data ownership, data localization and data sharing.

Sharing Tax Information in the 21st Century: Big Data Flows and Taxpayers as Data Subjects

In the last 10 years, governments have initiated several reforms to automatically exchange bulk taxpayer information with other governments (mainly via the Foreign Account Tax Compliance Act, the common reporting standard, and country-by-country reporting). This enhanced sharing of tax information has been encouraged both by technological change, including digitization, big data, and data analytics; and by political trends, including governments' efforts to reduce offshore tax evasion and aggressive international tax avoidance. In some cases, however, legal protections for taxpayer privacy and other interests are insufficiently robust for this emerging international sharing framework. Conceptually, taxpayers should be seen as "data subjects" whose rights are proactively protected by data protection laws and policies, including fair information practices. An optimal regime, which would balance the interests of taxpayers against those of tax authorities, should include a multilateral taxpayer bill of rights, a cross-border withholding tax that could be imposed in lieu of information exchange, and a global financial registry that would allow governments to identify the beneficial owners of business and legal entities.

Semantic-based privacy settings negotiation and management

By 2020, an individual is expected to own an average of 6.58 devices that share and integrate a wealth of personal user data. The management of privacy preferences across these devices is a complex task for which users are ill-equipped, which increases privacy risks. In this paper we propose an approach that exploits Semantic Web (SW) technology to manage the user’s IoT privacy preferences and negotiate the permissions for data sharing with third parties. SW technology comprises a web of data that can be processed by machines through a formal, universally shared representation. In our approach, SW enables a lightweight and interoperable communication between a Personal Data Manager (PDM) and the Third Parties (TPs) that request access to the user’s personal data. The PDM can handle multiple heterogeneous personal IoT devices and manages the negotiation process between the user and the TPs in a way that can relieve users from the burden of specifying their privacy requirement for each TP. The core of the approach is the definition of the Privacy Preference for IoT (PPIoT) Ontology which is based on the Privacy Preference Ontology, the W3C Semantic Sensor Network Ontology, the Fair Information Practices (FIP) principles, and state-of-the-art recommendation techniques for privacy protection in the IoT. This ontology aims to capture the complexity of privacy management in the IoT paradigm in light of the recent General Data Protection Regulation (GDPR) of the European Union. Along with presenting the ontology, in this paper we will provide an example on how to use the PPIoT ontology for the management of privacy preferences in the fitness IoT domain and we will show how the PDM handles the process of negotiation between the user and the TPs. The approach is based on an interactive PPIoT-based Privacy Preference Model (PPM) that meets the requirements of the GDPR to have transparent and simple TP privacy policies. Finally, we will report the results of an evaluation on a mockup fitness app that implements this PPM. The main contributions of this paper are: (i) to propose an ontology for privacy preference in the IoT context, which covers a knowledge gap in existing literature and can be used for IoT privacy management, (ii) to propose an interactive PPIoT-based Privacy Preference Model, which is in accordance with the GDPR objectives.

FIPPS & INFORMATION ASSURANCE: THE ROOT AND FOUNDATION

Within Information Science there are various concepts and among these Information Privacy and Security is an important one. Within this security among the important topics the Fair Information Practice is an important one. Fair Information Practice, in short, is called as FIPPs. It is the result of commission’s enquiry into the web in which online entities collect various personal information and also assure that practice in information is fair enough. The Fair Information Practice is a core for healthy information privacy protection. It is important to note that FTC has been engaged regarding online privacy from 1995. The Fair Information Practice basically was proposed in the year 1973 in the report called US Secretaries Advisory Committee on Automated Personal Data System. It was proposed to talk about records, computers, and Rights of the Citizen. The fundamental contribution of this committee was to design and development of codes for fair information practice for the betterment of Automated Personal Data System. It is important to note that this commission might also have played a big role in the development of Fair Information Practice Principle (FIIPs) in 1977as mentioned in their report called Personal Privacy in an Information Society. Information assurance is about the design, development, management of information related policies. It talks about the assurance of the content and information having manual and technological attributes. Information Assurance is a broader area of Security related areas. The FIIP is an important affair of Information Assurance. As Information Assurance is about the policy and framework designing hence in this paper several affairs leading to FIPPs, its role, and importance, its characteristics, features, and functions have been described in a brief manner.

China’s personal information protection in a data-driven economy: A privacy policy study of Alibaba, Baidu and Tencent

By examining the privacy policies of leading Chinese Internet and information service providers (IISPs), this study found their privacy policies to be generally compliant with China’s personal information protection provisions. These IISPs use proper mechanisms showing their commitment, measures and enforcement to data security, but their Fair Information Practices need improvement. Personal information protection in China is severe. Privacy policies offer more ‘notice’ than they do ‘choice’. Chinese IISPs collect and use information extensively in the guise of providing value to users, but have given insufficient consideration to transborder data flows and change of ownership. Societal and technological mechanisms have not been widely sought.

An information privacy culture instrument to measure consumer privacy expectations and confidence

PurposeThis paper aims to propose an information privacy culture index framework (IPCIF) with a validated information privacy culture index instrument (IPCII) to measure information privacy culture across nations. The framework is based on consumers’ privacy expectations, their actual experiences when organisations process their personal information and their general privacy concerns.Design/methodology/approachA survey method was deployed to collect data in South Africa – the first participating country in the study – to start building a global information privacy culture index (IPCI) and to validate the questionnaire.FindingsThe IPCI revealed that there seems to be a disconnect between what consumers expect in terms of privacy and the way in which organisations are honouring (or failing to honour) those expectations, which results in a breach of trust and the social contract being violated.Practical implicationsGovernments, information regulators and organisations can leverage the results of the privacy culture index to implement corrective actions and controls aimed at addressing the gaps identified from a consumer and compliance perspective. The validated IPCII can be used by both academia and industry to measure the information privacy culture of an institution, organisation or country to identify what to improve to address consumer privacy expectations and concerns.Originality/valueThe IPCIF and validated IPCII are the first tools that combine the concepts of consumer expectations and their confidence levels in whether organisations are meeting their privacy expectations, which are in line with the fair information practice principles and the privacy guidelines of the Organisation for Economic Cooperation and Development, to determine gaps and define improvement plans.