Internet Privacy Research

1. UWCISA Symposium on Information Systems Assurance 2005 Internet Privacy Research Framework, Review and Opportunities University of Waterloo Efrim Boritz Won Gyun No R. P. Sundarraj

2. Introduction Privacy in E-Commerce Privacy Research Framework Review and Research Opportunities Concluding Remarks Agenda

3. IntroductionE-commerce and Privacy Company Customers Internet Better Servicesthrough Customization Personal Information

4. Privacy and E-commerce Invasion of privacyUnauthorized collection, use, and transfer of personal information Risk related to the disclosure of personal information Privacy as an individual’s right regarding his or her personal information Definition Internet privacy is the individual’s right to access and control their personal information with respect to its collection, use, and transfer over the Internet. Privacy in E-commerce Scope and Definition

5. Customer Company Privacy in E-commerceHow Companies Collect Personal Information During a registration or ordering process • Name, e-mail, credit card etc. • Does not allow to collect information beyond demographics Capture IP (Internet Protocol) address • Behavioural information (Web pages viewed and sequences of visited pages) • Difficult to link behavioural information with specific customer information such as demographics Use of ‘Cookie’ • Allow to identify customer • Preferences and behavioural information are tracked and stored in the cookie.

6. Companies Personal Information Provide Useful Marketing Tactics Readily Available Personal Information Simplicity of Collection, Storage, Exchange, and Use • One of the Main Concerns of Customers While They Are Shopping Over The Internet (Porter, 2000; Smith et al., 1996) • Increasing Levels of Concern about Privacy among Internet Users (Culnan and Armstrong, 1999; FTC, 2000; Harris Interactive, 2002, 2003) Privacy in E-commerceCustomers’ Privacy Concerns Easier and More Tempting to Intrude on Customer Privacy Increasingly Competitive E-commerce Environment Requests for One-to-One Communication and Personalized Services Advances in Information Technology Create Privacy Concerns

7. Privacy in E-commerceMost Common Three Approaches • Governmental regulation • Privacy regulation governing the collection, use, and transfer of personal information • EU directive and PIPEDA (Canada ) • Industry self-regulation • Each company is responsible for developing its own privacy policy and deciding on the degree of information collection and use. • Privacy seals : Third-party enforcement programs for companies’ privacy practices • Privacy enhancing technologies • P3P (Platform for Privacy Preferences Project )A standardized, machine readable protocol for implementing privacy practicesAT&T privacy bird (www.privacybird.com) • Anonymizer (www.anonymizer.com): Allows to users browse Web pages with complete anonymity

8. Studies included in the review Between 1995 to 2005 in the field of information systems, business and marketing (There were approximately 210 studies) 71 studies selected based on our definition of Internet privacy. We excluded studies that investigate the privacy of health information. Review of Internet Privacy Research • Privacy research framework created: • To organize prior studies • To understand entities involved in internet privacy and interactions between them • To identify research opportunities

9. Internet Privacy Research on Internet Privacy Smith (2001) Milberg et al. (1995) Liu and Arnett (2002) Desai, Richards, and Desai (2003) • Factors that might influence or moderate government approach.e.g., Economic trends (dot.com bubble) and national security (Sept. 11) • Governmental regulation vs. Self-regulation Westin (2003) Sheehan (2002) Sheehan and Hoy (1999) • Extent to which companies data collection activities comply with their stated privacy policy • The effect of companies’ privacy practices (short-term and long-term) • Differences in privacy practices across countries • Theory-based conceptual framework • Individual’s privacy concerns and actual privacy behaviour • Difference in customers’ privacy concerns across different cultures

10. Internet Privacy Research on Internet Privacy Jamal et al. (2003) Gurau, Ranchhod, & Gauzente (2003) Milberg, Smith, and Burke (2000) Sheehan and Hoy (2000) • Do companies benefit by addressing their own concerns about customer privacy? • Self-reported behaviour vs. Actual behaviour • Why are privacy seals not popular? • Are governmental regulations enough to ensure customers’ privacy concerns? • Do customer concerns influence government regulation approaches? • Do companies provide enough privacy protections as required by government? • Do governmental regulation approaches influence companies’ privacy practices? Palmer, Bailey, and Faraj (2000) Earp and Baumer (2003)

11. Internet Privacy Research on Internet Privacy Other Factors(Technology, Social and Economical Factors, etc.) Cranor, Arjula, and Guduru (2002) Rust, Kannan, and Peng (2002) Culnan and Bies (2003) • How do customers perceive new privacy protection technologies? • Short-term and long-term consequences of loss of privacy to individuals and to society as a whole Research in this area is just beginning to emerge.

12. Summary • Addressed Privacy in E-commerce • Introduced a Privacy Research Framework • Reviewed Prior Research on Internet Privacy • Discussed Several Opportunities for Future Research

13. Questions & Suggestions