Introducing The Equilibrium Model? of Privacy Calculus Theory

An attempt to provide a comprehensive model to explain the privacy paradox phenomenon based on privacy calculus theory.

Introduction

Our lives are enriched with our online and digital extensions, enabled by technological innovations. We generated and consumed around 79 Zettabytes of data in 2021, which is estimated to grow to 181 Zettabytes in 2025 (Statista, 2021). But under the shadows of personalised, convenient, and free services and a fruitful of benefits we enjoy every day, there is a distressful truth; We are trading our privacy for benefits, and mostly by intention.

Our digital capabilities have numerous advantages for us, but they also allow data-capture equipment to our lives (Gerber et al., 2018). The birth of the Semantic Web unlocked mind-blowing possibilities, such as almost unlimited access to data and information, ongoing social networking opportunities, and massive data aggregation (Barth & Jong, 2017). The straightforward automated processes of gathering, storing, and analysing tremendous volumes of consumer data have grown dramatically, and associated costs of related activities have decreased with the development of highly advanced technologies (Norberg et al., 2007). Marketers have been thrilled with knowing the customers better than ever. Ultra-efficient communications and audience targeting perfectly matched those groups' needs and desires (Moon, 2000). Information privacy concerns have been highlighted in the press as a critical drawback of the "information era", and developing suitable privacy policies has been a major challenge for authorities (Norberg, 2007). Despite the worries about the possible decline of personal privacy and its consequences, tech companies keep utilising their new products and services based on our personal information (cf. Cavoukian and Hamilton, 2002; Whiting, 2002; Williams, 2002).

The public has constantly communicated their data privacy concerns through formal and informal channels. They feel out of control over their data (81% of US citizens) and believe their personal data is less secure than five years ago (Pew, 2019). Australian citizens indicate that online services, including social networks, are a bigger threat than ID fraud and theft (32% compared to 19%) (The Australian Community Attitudes to Privacy Survey, 2017). Online privacy concerns arose between 2013 and 2014 among Asian users (such as Japan, India, China, South Korea, and Hong Kong), African users (such as Egypt, Nigeria, and Kenya), South American users (Brazil), and Canadian users (Ipsos and Centre for International Governance Innovation, 2014; Ipsos MORI, 2014).

Traditionally, scholars believed that privacy behaviours and intention are correlated; however, the idea that there is such a permanent link is called into doubt by various research done in the privacy domain (Poikela et al., 2015). There is a discrepancy between users' concerns, intentions and attitudes toward privacy and their actual behaviour regarding personal information disclosure. Users profess to be highly worried about their privacy; nevertheless, they do not seem to do much to safeguard their personal information on the web (Barth & Jong 2017). In the last two decades, many scholars have accepted the challenge to reason or even deny the phenomenon known as the ‘Privacy Paradox’, yet to this day, it has resisted most attempts. A comprehensive explanation or a point of agreement among experts seems unreachable.

By focusing on the “Privacy Calculus Theory” as the leading theory addressing the issue, this paper aims to take our understanding of the subject some steps further by analysing the most credible papers, meta-analyses research, and systematic literature reviews to develop a new hypothetical model called ‘The Equilibrium Model of Privacy Calculus’. This paper only relies on studies which conducted or analysed well-organized surveys or experiments and have demonstrated strong statistical power for their claims. However, other theoretical and psychological explanations have been reviewed to decode the logic behind related concepts and better data interpretation. We believe that understanding the privacy paradox is crucial because even after introducing data protection regulations, no significant change in people’s concerns or behaviours has been observed. Less than 12% of EU residents have acted on their privacy rights based on GDPR (Strycharz et al., 2020) and based on the UK business data survey (2021), 26% of businesses observed no benefit in the regulations, while 56% believed it did not make them more responsible.

The Equilibrium Model? of Privacy Calculus Theory

In explaining privacy calculus and privacy decisions, there are no simple answers. Complex issues require sophisticated approaches, and when we are dealing with an unidentified complex subject, it is sometimes best to adopt models that give us the flexibility we need to interpret our findings. This paper offers a visual model based on the privacy calculus theory that can trustfully represent the dynamic of variable interactions regarding information disclosure.

Think of the privacy calculus process as a ‘weighting balance’ that consists of different parts. In a normal weighting balance, the set point is in the middle, and all parts are standardised for fair judgment.

Now let's assume each part of this hypothetical model represents a cluster of variables representing the main elements of the privacy calculus theory.

Privacy Attitude: The term initially refers to how people generally feel about certain privacy actions.

Privacy Intention: Our intended outcome from a privacy perspective can vary from disclosure intention since privacy intention concerns privacy, while disclosure intention may concern perceived value and benefits. Some researchers evaluate privacy intention instead of focusing on privacy behaviour. These studies ignore a crucial element of the paradox; the fact that intentions of privacy often do not result in protective behaviour (Kokolakis, 2015), but as Gerber et al. (2017) showed, it is still a strong predictor of privacy behaviour.

Privacy Concerns: Though closely related, the two concepts, privacy concerns and privacy attitudes, are essentially distinct. While privacy attitudes pertain to the evaluation of privacy behaviours, privacy concerns can be relatively general and, in most circumstances, are not confined to any specific setting (Kokolakis, 2015).

Privacy Behaviour: This variable is measured by the real actions of individuals in sharing or revealing personal information, and the whole theory of privacy paradox relies on the dichotomy between privacy behaviour and privacy concerns and intention. In this model, the privacy behaviour threshold represents the action taken after the evaluation; if benefits are valued more, the disclosure action will take place, and if costs cross the threshold, no information will be communicated or shared intentionally.

Context: Morando et al. (2014) argue that information privacy behaviours are significantly contextual and can vary in different situations. Context can easily stimulate our behaviour and trigger biases and privacy valuation failure.

Benefits: Can be interpreted as all functional, emotional and societal benefits that an action or behaviour can result. In some studies, similar terms, such as perceived benefit or perceived value, have also been used instead. We believe perceived value is not an accurate term to be replaced for benefits since it has different definitions in marketing disciplines.

Costs: Privacy calculus theory has some equal terms, such as risk-benefit/cost-benefit calculation. Some studies only focused on privacy risks and have neglected other possible costs such as mind barriers, efforts, and monetary costs in privacy behaviours. Therefore, we suggest using the ‘Cost’ term instead of ‘Risk’. The perceived value of an action can also be investigated by calculating benefits vs. costs.

First Scenario: The Normal Equilibrium of Privacy Calculus

In this scenario, the user is not affected by any internal or external factors and is completely able to perform a sound and rational mental process of privacy calculus. In this situation, three different situations can occur:

a) Perceived value is positive, meaning benefits, including functional and emotional, provide more value than all costs of any kind. In this situation, the weighting balance will lean into the ‘privacy behaviour threshold’ with benefits driving the privacy behaviour.

b) Perceived value is negative, meaning costs are higher than benefits. In this situation, costs will lean into the privacy behaviour threshold, leading to no information disclosure.

c) Perceived Value is zero, meaning benefits and costs are equal, and there will be no action.

a) Perceived value is positive

The benefits (functional, emotional, or social) outweigh the costs in the first situation, which leads to a change in the equilibrium dynamic of privacy calculus. Benefits cross the privacy behaviour threshold, meaning the information disclosure will occur.

Greater benefits could lead to information disclosure, although this won’t deny the fact that considerable privacy costs will influence privacy concerns, and privacy concerns have proved to influence privacy intentions. When this behaviour repetitively occurs, privacy concerns and lack of control can accumulate worries after several repetitions of the same actions. For example, obese people have high health concerns because of their obesity and repetitive failures in behavioural intentions. People have high privacy concerns because they feel incapable of reaching the intended privacy outcomes. This paper argues that privacy costs are fully recognised in this situation and can influence concerns even after a mindful decision of disclosure.

Another neglected aspect of many studies is the fact that comparing a fruitful of benefits versus privacy costs (and, in many cases, simply privacy risks) was never a fair comparison in the first place. The online extension of lives has grown to the extent that we can argue that we will not be able to perform our daily routines and responsibilities properly without engaging in acts that will lead to personal information disclosure. Nowadays, the Internet is an ‘irreversible innovation’ and has become indispensable in our lives (Hoffman et al., 2004).

b) Perceived value is negative

If costs (efforts, risks, monetary costs, etc.) are perceived as greater than benefits, then costs will cross the privacy behaviour threshold, resulting in no information disclosure.

?

c) Perceived Value is zero

In this situation, benefits are equally high or equally low as costs in the privacy calculation process, or no significant benefits have been found to perform the calculus.

Second Scenario: Internal and external factors, biases, and valuation errors impact the Equilibrium of the Privacy calculus.

Many studies have proved how heuristics, cognitive biases, information structure & design, and bounded rationality, and valuation errors can impact our privacy decisions. The model clearly shows and recognises the fact that multiple internal and external factors and stimulators can impact the equilibrium. They can influence our privacy intention and shift our set point for privacy judgment. Zareef and P. Tejay (2020) conducted a neuroimaging study with an EEG device that proved privacy decisions are both rational and emotional; moreover, we know that benefits and costs consist of multiple emotional and highly abstract values.?

Conclusions and recommendations

This paper invites future studies to apply more marketing theories and disciplines besides social and behavioural theories. For instance, it is best to consider Cost-benefit calculus as a process that pursues perceived value. Patterson and Spreng (1997) state that perceived value is “a ratio or trade‐off of total benefits received to total sacrifices,” and Zeithaml (1988) argues that “what we receive” and “what we give” decide whether a product or service has perceived value or not. Accordingly, we also argue that it is better to categorise benefits as ‘Emotional’, ‘Functional, and ‘Societal’. We believe companies designing these digital products and services follow various marketing disciplines and approaches, social science studies, A/B testing, and continuous improvement based on consumer behaviours.

We recommend that authorities raise consumers' awareness regarding the application of data protection regulations and encourage businesses to develop data privacy management tools and settings that let users adjust their privacy on demand and without inconvenient consequences. Also, by isolating factors that can cause heuristics, cognitive biases, and privacy judgmental errors, we can help authorities develop fair and mature regulations that revive our privacy confidence and control.

This paper encourages scholars to utilise flexible and comprehensive visual models without sacrificing accuracy for complex theories. It has provided the equilibrium model for privacy calculus to help researchers develop a better understanding of the privacy paradox because it argues that a better understanding of this phenomenon will lead to more sophisticated regulations and less privacy erosion.

References

·?????? Acquisti A, Grossklags J. Privacy and rationality in individual decision making. IEEE Secur Priv 2005;2:24–30.

·?????? Acquisti A, Grossklags J. What can behavioral economics teach us about privacy. In: Acquisti A, Gritzalis S, Lambrinoudakis C, di Vimercati S, editors. Digital privacy: theory, technology, and practices. Auerbach Publications; 2007. p. 363–77.

·?????? Ajzen, I., 1985. From intentions to actions: a theory of planned behavior. In: Kuhl, J., Beckman, J. (Eds.), Action-Control: From Cognition to Behavior. Springer, Heidelberg, pp. 11–39.

·?????? Ajzen, I., Fishbein, M., 1980. Understanding Attitudes and Predicting Social Behavior. Prentice-Hall, Englewood Cliffs, NJ.

·?????? Australian Community Attitudes to Privacy Survey. (2017) https://www.oaic.gov.au/engage-with-us/research/2017-australian-community-attitudes-to-privacy-survey/report

·?????? Auxier, b., Rainie, L., Anderson, M., Perrin, A., Kumar, M., Turner. E., (2019) PEW Research Center. https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information/

·?????? Barth, S., & De Jong, M. D. (2017). The privacy paradox–Investigating discrepancies between expressed privacy concerns and actual online behavior–A systematic literature review.?Telematics and informatics,?34(7), 1038-1058.

·?????? Barnes SB. A privacy paradox: social networking in the United States. First Monday 2006;11(9).

·?????? Brown B. Studying the internet experience. HP Laboratories Technical Report (HPL-2001-49). https://www.hpl.hp.com/techreports/2001/HPL-2001-49.pdf; 2001

·?????? Busemeyer, J. R., Wang, Z., & Townsend, J. T. (2006). Quantum dynamics of human decision-making.?Journal of Mathematical Psychology,?50(3), 220-241.

·?????? Cavoukian, Ann and Tyler Hamilton. 2002. Whither Privacy, post–9/11? Toronto Star, September 9, 2002: D3.

·?????? Culnan, M. J., & Armstrong, P. K. (1999). Information privacy concerns, procedural fairness, and impersonal trust: An empirical investigation.?Organization science,?10(1), 104-115.

·?????? Chen, H.-T., Chen, W., 2015. Couldn’t or wouldn’t? The influence of privacy concerns and self-efficacy in privacy management on privacy protection. Cyberpsychol. Behav. Social Networking 18 (1), 13–19.

·?????? Crutchfield, R.S., 1955. Conformity and character. Am. Psychol. 10 (5), 191–198.

·?????? Cohen, J. (2013). Statistical power analysis for the behavioral sciences. Routledge.

·?????? Davison, W., 1983. The third-person effect in communication. Public Opin. Q. 47 (1), 1–15.

·?????? Debatin, B., Lovejoy, J. P., Horn, A. K., & Hughes, B. N. (2009). Facebook and online privacy: Attitudes, behaviors, and unintended consequences. Journal of computer-mediated communication, 15(1), 83-108.

·?????? Deuker, A. (2010). Addressing the privacy paradox by expanded privacy awareness–the example of context-aware services. In IFIP PrimeLife international summer school on privacy and identity management for life (pp. 275-283). Springer, Berlin, Heidelberg.

·?????? Department for Digital, Culture, Media and Sport. (2021), UK Business Data Survey summary report, https://www.gov.uk/government/statistics/uk-business-data-survey-2021

·?????? Dienlin T, Trepte S. Is the privacy paradox a relic of the past? An in-depth analysis of privacy attitudes and privacy behaviors. Eur J Soc Psychol 2015;45(3):285–97.

·?????? Dinev, T., Hart, P., 2006. An extended privacy calculus model for e-commerce transactions. Inf. Syst. J. 17 (1), 61–80.

·?????? Donnenwerth, G.V., Foa, U.G., 1974. Effect of resource class on retaliation to injustice in interpersonal exchange. J. Pers. Soc. Psychol. 29 (6), 785–793.

·?????? Downs, A., 1957. An economic theory of political action in a democracy. J. Political Economy 65 (2), 135–150.

·?????? Donna L. Hoffman, Thomas P. Novak, and Alladi Venkatesh. 2004. Has the Internet become indispensable? Commun. ACM 47, 7 (July 2004), 37–42. https://doi.org/10.1145/1005817.1005818

·?????? Eric J. Smith & Nina A. Kollars?(2015)?QR Panopticism: User Behavior Triangulation and Barcode-Scanning Applications,?Information Security Journal: A Global Perspective,?24:4-6,?157-163,?DOI:?10.1080/19393555.2015.1085113

·?????? Faul, F., Erdfelder, E., Buchner, A., & Lang, A. G. (2009). Statistical power analyses using G* Power 3.1: Tests for correlation and regression analyses. Behavior research methods, 41(4), 1149-1160.

·?????? Flender C, Mu?ller G. Type indeterminacy in privacy decisions: the privacy paradox revisited. In: Quantum interaction. Berlin Heidelberg: Springer; 2012. p. 148–59.

·?????? Gambino, A., Kim, J., Sundar, S. S., Ge, J., & Rosson, M. B. (2016, May). User disbelief in privacy paradox: Heuristics that determine disclosure. In Proceedings of the 2016 CHI Conference Extended Abstracts on Human Factors in Computing Systems (pp. 2837-2843).

·?????? Georgia Tech Research Corporation, (1996), “Fifth WWW User Survey,” URL: https://www.cc.gatech.edu/gvu/user surveys. April

·?????? Gerber, N., Gerber, P., & Volkamer, M. (2018). Explaining the privacy paradox: A systematic review of literature investigating privacy attitude and behavior.?Computers & security,?77, 226-261.

·?????? Giddens, A., 1984. The Constitution of Society: Outline of the Theory of Structuration. University of California Press, Oakland.

·?????? Hann IH, Hui KL, Lee SYT, Png IP. Overcoming online information privacy concerns: an information-processing theory approach. J Manage Inform Syst 2007;24(2):13–42.

·?????? Holvast, J. (1993). Vulnerability and privacy-are we on the way to a risk-free society. Facing the challenge of risk and vulnerability in an information society, 33, 267-279.

·?????? Huberman BA, Adar E, Fine LR. Valuating privacy. IEEE Secur Priv 2005;3(5):22–5.

·?????? Ipsos & Centre for International Governance Innovation (2014). 83% of global internet users believe affordable access to the internet should be a basic human right . Ipsos & Centre for International Governance Innovation. https://www.cigionline.org/sites/ default/files/documents/internet- survey- 2014- factum.pdf/ Accessed 01 March 2017.

·?????? Ipsos MORI (2014). Global trends: personalisation vs . privacy. Ipsos MORI. https://www.ipsosglobaltrends.com/ personalisation- vs- privacy.html/ Accessed01March 2017.'

·?????? Jensen C, Potts C, Jensen C. Privacy practices of Internet users: self-reports versus observed behavior. Int J Hum Comput Stud 2005;63(1):203–27.

·?????? Jia, H., Wisniewski, P. J., Xu, H., Rosson, M. B., & Carroll, J. M. (2015, February). Risk-taking as a learning process for shaping teen's online information privacy behaviors. In Proceedings of the 18th ACM Conference on Computer Supported Cooperative Work & Social Computing (pp. 583-599).

·?????? Kahneman, D., 2003. Maps of bounded rationality: Psychology for behavioral economics. Am. Econ. Rev. 93 (5), 1449–1475.

·?????? Kehr, F., Wentzel, D., Kowatsch, T., 2014. Privacy paradox revised: Pre-existing attitudes, psychological ownership, and actual disclosure. In: Thirty Fifth International Conference on Information Systems, Auckland, New Zealand, 1–12.

·?????? Kehr, F., Kowatsch, T., Wentzel, D., Fleisch, E., 2015. Blissfully ignorant: the effects of general privacy concerns, general institutional trust, and affect in the privacy calculus. Inf. Syst. J. 25 (6), 607–635.

·?????? Laufer, R. S., & Wolfe, M. (1977). Privacy as a concept and a social issue: A multidimensional developmental theory.?Journal of social Issues,?33(3), 22-42.

·?????? Moon, Youngme. 2000. Intimate Exchanges: Using Computers to Elicit Self-Disclosure from Consumers. Journal of Consumer Research, 26 (March): 323–339.

·?????? Mothersbaugh DL, Foxx WK, Beatty SE,Wang S. Disclosure antecedents in an online service context: the role of sensitivity of information. J Serv Res 2012;15(1):76–98.

·?????? Motiwalla, L.F., Li, X., Liu, X., 2014. Privacy paradox: Does stated privacy concerns translate into the valuation of personal information?. In: Proceeding of the 19th Pacific Asia Conference on Information Systems (PACIS 2014), Paper 281.

·?????? Mohammed, Z. A., & Tejay, G. P. (2021). Examining the privacy paradox through individuals’ neural disposition in e-commerce: An exploratory neuroimaging study.?Computers & Security,?104, 102201.

·?????? Morando F, Iemma R, Raiteri E. Privacy evaluation: what empirical research on users’ valuation of personal data tells us. Internet Policy Rev 2014;3(2):1–11.

·?????? Milne, G. R., & Gordon, M. E. (1993). Direct mail privacy-efficiency trade-offs within an implied social contract framework.?Journal of Public Policy & Marketing,?12(2), 206-215.

·?????? Norberg PA, Horne DR, Horne DA. The privacy paradox: personal information disclosure intentions versus behaviors. J Consum Aff 2007;41(1):100–26.

·?????? O’Donoghue, T., Rabin, M., 2001. Choice and procrastination. Quart. J. Econ. 116 (1), 121–160.

·?????? Patterson, P.G. and Spreng, R.A. (1997), “Modelling the relationship between perceived value, satisfaction and repurchase intentions in a business‐to‐business, services context: an empirical examination”, International Journal of Service Industry Management, Vol. 8 No. 5, pp. 414‐34.

·?????? Pentina, I., Zhang, L., Bata, H., Chen, Y., 2016. Exploring privacy paradox in information-sensitive mobile app adoption: a cross-cultural comparison. Comput. Hum. Behav. 65, 409–419.

·?????? Poikela, M., Schmidt, R., Wechsung, I., Mueller, S., 2015. FlashPolling privacy: The discrepancy of intention and action in location-based poll participation. In: Adjunct Proceedings of the 2015 ACM International Joint Conference on Pervasive and Ubiquitous Computing and Proceedings of the 2015 ACM International Symposium on Wearable Computers, Osaka, Japan, 813–818.

·?????? P?tzsch, S., & Borcea-Pfitzmann, K. (2009, September). Privacy-respecting access control in collaborative workspaces. In IFIP PrimeLife International Summer School on Privacy and Identity Management for Life (pp. 102-111). Springer, Berlin, Heidelberg.

·?????? Princi, E., & Kr?mer, N. C. (2020). Out of Control – Privacy Calculus and the Effect of Perceived Control and Moral Considerations on the Usage of IoT Healthcare Devices. Frontiers in Psychology, 11. https://doi.org/10.3389/fpsyg.2020.582054

·?????? Quinn, K. (2016). Why we share: A uses and gratifications approach to privacy regulation in social media use. Journal of Broadcasting & Electronic Media, 60(1), 61-86.

·?????? Roback, D., & Wakefield, R. L. (2013). Privacy risk versus socialness in the decision to use mobile location-based applications. ACM SIGMIS Database: the DATABASE for Advances in Information Systems, 44(2), 19-38.

·?????? Rosenberg, R. S. (2013). The social impact of computers. Elsevier.

·?????? Simon, H.A., 1982. Models of Bounded Rationality. MIT Press, Cambridge, MA.

·?????? Spiekermann S, Grossklags J, Berendt B. E-privacy in 2nd generation e-commerce: privacy preferences versus actual behavior. In: Proceedings of the 3rd ACM conference on electronic commerce. October 14–17 Florida, USA; 2001.

·?????? Stone, E. F., & Stone, D. L. (1990). Privacy in organizations: Theoretical issues, research findings, and protection mechanisms.?Research in personnel and human resources management,?8(3), 349-411.

·?????? Statista, 2021. “Volume of data/information created, captured, copied, and consumed worldwide from 2010 to 2020, with forecasts from 2021 to 2025”, [Chart],? https://www.statista.com/statistics/871513/worldwide-data-created/

·?????? Soper, D. S. (2021). A-priori sample size calculator for structural equation models [Software]. 2021.

·?????? Staddon J, Acquisti A, LeFevre K. Self-reported social network behavior: accuracy predictors and implications for the privacy paradox. In: Proceedings of the 2013 international conference on social computing (SocialCom 2013), September 8–14, Washington, USA; 2013.

·?????? Strycharz, J., Ausloos, J., & Helberger, N. (2020). Data protection or data frustration? Individual perceptions and attitudes towards the GDPR. Eur. Data Prot. L. Rev., 6, 407.

·?????? Sundar SS, Kang H,Wu M, Go E, Zhang B. Unlocking the privacy paradox: do cognitive heuristics hold the key? In: Proceedings of CHI’13 extended abstracts on human factors in computing systems, April 27–May 2, Paris, France; 2013.

·?????? Vroom, V.H., 1964. Work and Motivation. Wiley, New York.

·?????? Whiting, Rick. 2002. Wary Customers Don’t Trust Businesses to Protect Privacy. Information Week, August 19, 2002: 34.

·?????? Williams, Elisa. 2002. The Man Who Knows Too Much. Forbes, November 11, 2002: 68–70.

·?????? Wilson, D.W., Valacich, J.S., 2012. Unpacking the privacy paradox: Irrational decision-making within the privacy calculus. In: Thirty Third International Conference on Information Systems, Orlando, Florida, 1-11

·?????? Zafeiropoulou, A. M., Millard, D. E., Webber, C., & O'Hara, K. (2013, May). Unpicking the privacy paradox: can structuration theory help to explain location-based privacy decisions?. In Proceedings of the 5th Annual ACM Web Science Conference (pp. 463-472).

·?????? Zeithaml, V.A. (1988), “Consumer perceptions of price, quality and value: a means‐end model and synthesis of evidence”, Journal of Marketing, Vol. 52 No. 3, pp. 2‐22.