Privacy Assimilation in - EFY CONFERENCES · Agenda 4 Introduction Motivation Gaps and research...
-
Upload
vuongtuyen -
Category
Documents
-
view
216 -
download
0
Transcript of Privacy Assimilation in - EFY CONFERENCES · Agenda 4 Introduction Motivation Gaps and research...
Privacy Assimilation in
IT Organizations:
Carving out Privacy
from Security
V S Prakash Attili
Education, Training and Assessment, Infosys Limited
Research in collaboration with
Privacy Relevance to IoT
3
• In the IoT era, organizations play critical role in handling information from physical
devices, vehicles, home appliances (which includes personal/sensitive information), and
effective privacy frameworks at an organisational levels will be utmost important.
• Organizations best security polices still struggle to retain clients if the privacy policies
are immature, especially in the IoT era.
• Effective privacy enforcement will reduce the damage to individuals and organizations
even in case of data breach.
• A customized framework for implementing the privacy assimilation, a predominantly
perceptive and culture entity go long way in holistic data protection.
Agenda
4
✓ Introduction
✓ Motivation
✓ Gaps and research objectives
✓ Literature
✓ Theories used in privacy & security studies
✓ Methodology
✓ Qualitative study
✓ Qualitative data analyses
✓ Hypotheses
✓ Research model
✓ Scale development
✓ Measurement model
✓ Results - discussions
✓ Contributions and limitations
✓ Future directions and conclusion
Introduction
5
➢ Growth of digital universe
(Gantz & Reinsel, 2012; Turner, Gantz, Reinsel, & Minton, 2014)
✓ Key highlights IDC reports 2012, 2014 - Size of digital universe
▪ 130 Exabytes (2005), 1227 Exabytes OR 1.2 ZB (2010)
▪ 4.4 ZB (2013), 44 ZB (2020) i.e. 44 “trillion gigabytes” forecasted non linear growth
✓ Projections 2020
▪ Enterprises have some liability for 80% of data in the digital universe at some point
▪ Increase in demand for data protection the projection (40%)
➢ Rise of privacy concerns
✓ Since January 2005 (In US), 912 million records through 5,436 data breaches (Clearinghouse, 2017)
✓ Organizations can successfully secure the stored personal information but still make bad decisions about the
subsequent use of personal information, resulting in information privacy problems. (Culnan & Williams 2009)
✓ Studies of Chan et al. (2005) and Greenaway et al. (2015) highlighted organizational imperative to address
privacy, distinct from security.
✓ Over 80 countries and independent territories have now adopted comprehensive data protection laws including
nearly every country in Europe and many in Latin America and the Caribbean, Asia, and Africa.
Motivation
6
➢ Background
✓ Global Information Security Survey (GISS) privacy questionnaire, 38% of respondents admitted that they
addressed security in new business processes and technologies, but not privacy specifically (Ernst & Young
2015)
✓ Several countries enacting or strengthening data protection laws (Greenleaf, 2014)
✓ Emerging technology trends like cloud, big data posing privacy and security challenges (Rubinstein, 2013)
✓ IS studies had also reported scarcity of privacy studies at organizational level as against individual level
(Belanger & Crossler, 2011).
➢ Academic studies analyzed the interplay between the external institutional forces and the internal factors at an
organizational level with reference to security assimilation, not privacy (Hsu et al., 2012; Tejay & Barton, 2013).
➢ Broad enquiry
✓ What are the external forces and internal mechanisms influencing information privacy of IT organizations?
✓ How do external forces act internally to make organizational information privacy assimilated in the strategies
and actions of IT organizations?
Gaps and research objectives
7
➢ Research gaps
✓ There is a paucity of research on information privacy at organizational level in general (Belanger and
Crossler, 2011)
✓ IS research addressing the emerging concerns of the IT industry, particularly addressing the potential for the
leverage of information privacy practice as an element of strategy has received little attention in academic
research
✓ Previous research on IT and its diffusion and assimilation has informed practice on leveraging IT for business
strategy (Armstrong and Sambamurthy, 1999). It is still not very clear how institutional forces influence
information privacy assimilation and the factors driving the same within an organization
➢ Research objectives
The following specific objectives have been framed to guide further work:
✓ identify specific variables that influence senior management participation for privacy practice
✓ understand the interactions among internal and external forces that influence information privacy assimilation
✓ develop a theoretical model following inductive and deductive methods to explain information privacy
assimilation and
✓ test the model using a sample drawn from the Indian IT industry.
Literature
8
➢ Privacy emphasis
✓ Organizations can successfully secure the stored personal information but still make bad decisions about the
subsequent use of personal information, resulting in information privacy problems (Culnan and Williams 2009)
✓ Studies of Chan et al. (2005) and Greenaway et al. (2015) highlighted organizational imperative to address
privacy, distinct from security
➢ Privacy definitions
✓ Value based definitions
▪ Privacy as a Right - The right to be left alone (Warren & Brandeis, 1890)
▪ Privacy as a Commodity - Subject to economic principles of cost benefit analysis and trade-off (Bennett, 1995)
✓ Cognate based definitions
▪ Privacy as a State - A state of limited access to information of ourselves (Westin, 1967)
▪ Privacy as Control - Control of information about ourselves (Altman, 1975)
✓ AICPA-GAPP (American Institute of Chartered Public Accountants)
▪ The rights and obligations of individuals and organizations with respect to the collection, use, disclosure, and
retention of personally identifiable information (PII)
Literature
9
Privacy Baseline
(1945-60)
1st Era, (1961-79)
2nd Era
(1980-90)
3rd Era
(1990-02)
➢ Privacy evolution (Westin, 2003)
Limited IT developments
Rise of the internet, web
In the last one decade
Rise of social networks
(Facebook, Twitter, WhatsApp),
Ease of information sharing,
Information privacy is gaining
more focus across world
Theories used in privacy & security studies
10
Theory Authors
Compliance theory (Chen, Ramamurthy and Wen, 2012)
Criminology theories (Hu, Xu, Dinev and Ling, 2011; M. Siponen and Vance, 2010; Willison and
Backhouse, 2006)
Communication theory and fear
appeals model
(Johnston and Warkentin, 2010; Spears and Barki, 2010)
Control theory (Boss, Kirsch, Angermeier, Shingler and Boss, 2009)
Elaboration likelihood model
related to human behavior
(Johnston and Warkentin, 2010; Takagi and Takemura, 2013)
General deterrence theory (D'Arcy, Hovav and Galletta, 2009; Straub Jr, 1990)
Learning theories (Puhakainen and Siponen, 2010)
Theory of reasoned action (M. T. Siponen, 2000)
Theory of planned behavior (Bulgurcu, Cavusoglu and Benbasat, 2010; Dinev and Hu, 2005; Hu, Dinev,
Hart and Cooke, 2012; M. T. Siponen, 2000)
Institutional theory (Bjorck, 2004; Hsu, Lee and Straub, 2012; Hu et al., 2012; Hu, Hart, and
Cooke, 2007; Tejay and Barton, 2013)
Neo-institutional theory
11
➢ Neo institutional theory (P. DiMaggio & Powell, 1982; P. J. DiMaggio & Powell, 1991; Powell & DiMaggio, 2012)
✓ Institutional isomorphism by three primary forces
Coercive - external influences from regulatory, political, societal
Mimetic - uncertain environments
Normative - professionalization of the workforce
➢ Applicability as per literature
✓ Information System security research
(Bjorck, 2004; Hsu et al., 2012; Hu et al., 2012; Hu, Hart, & Cooke, 2007; Tejay & Barton, 2013)
✓ Information privacy research
(Chan & Greenaway, 2005; Kshetri, 2013)
Assimilation
12
➢ Assimilation: As an extent to which the use of technology/innovation diffuses across the organizational work progress
and become routinized in the activities associated with those process.
(Chatterjee, Grewal, & Sambamurthy, 2002; Cooper & Zmud, 1990; Fichman & Kemerer, 1997)
➢ Assimilation (strategy + activities): Investment in a technology/innovation, how well firms able to assimilate that
specific technology/innovation to leverage business value
(Armstrong & Sambamurthy, 1999; Purvis, Sambamurthy, & Zmud, 2001)
➢ Assimilation studies:
✓ Assimilation of Software Process innovations (Fichman & Kemerer, 1997)
✓ IT Assimilation in Firms (Armstrong & Sambamurthy, 1999)
✓ Assimilation of IT Innovations (Fichman, 2000)
✓ Assimilation of Knowledge Platforms (Purvis et al., 2001)
✓ Assimilation of Complex Technological Innovations (Gallivan, 2001)
✓ Web technology Assimilation (Chatterjee et al., 2002)
✓ Assimilation of ERP packages (Liang et al., 2007)
✓ Assimilation of Security-Related Policies (Gallagher, Zhang, & Gallagher, 2012)
Privacy assimilation : Need of the hour in IT Organizations?
Methodology
13
➢ Mixed methods design
✓ Following Creswell (2009) and Saunders et al. (2009), this work employs a sequential mixed method approach (uses
a combination of qualitative and quantitative methods in succession) to examine the interplay between the external
forces and internal influencers on privacy assimilation within IT organizations
➢ Qualitative study
✓ Multi-case, multi-site approach - Thematic analysis
✓ Important variables from neo-institutional theory for Initial semi-structured interview question
✓ Combination of inductive and deductive principles (Davis and Eisenhardt, 2011)
Privacy assimilation framework in IT organizations
➢ Quantitative study
✓ Survey method, adopted and tested instrument
✓ PLS path modelling used for hypotheses testing
Qualitative study
14
➢ Key highlights Link to data sample
✓ Duration : Aug-2015 to Nov-2015
✓ Interviews were conducted either in-person or telephonically
✓ Each interview lasted about 40 minutes on an average
➢ Coding procedure
✓ More than 25,000 words transcribed, analysed and coded following thematic analysis procedure
✓ 41 major themes with 287 quotations were extracted that best represented the identified themes
✓ Two external coders involved; Holsti’s (1969) code of reliability is 0.78
➢ Data triangulation
✓ Websites of the companies
✓ Industry bodies and reports of consulting companies
Qualitative data analyses
15
✓ Eight (8) constructs emerged, 5 - 6 themes under each construct
Label (Braun and Clarke, 2006)
▪ Y++ used to represent two thirds (or more) of participants have statements supporting the theme, similar to the “majority of
participants”
▪ Y+ used to denote more than one third of participants supporting the theme, similar to ‘many participants’
▪ Y used to denote two or more participants responded in support of a theme
Construct Indicator Themes LabelLiterature reference
for Instrument
Coercive Force
(COER)
COER1 : Government,
regulatory influence
It is important for our organization to comply
with government regulations on information
privacy
Y++
(Cavusoglu et al., 2015)
(Tejay and Barton, 2013)
(Johnson, 2009)
(Liang et al., 2007)
(Ang and Cummings,
1997)
COER2 : Contracts
with other businesses
Contractual terms force organizations to have
established information privacy practicesY (Tejay and Barton, 2013)
COER3 : Customer
expectations
Customers expect our organization to protect
their (private) informationY+
(Cavusoglu et al., 2015)
(Tejay and Barton, 2013)
(Bjorck, 2004)
(Teo et al., 2003)
COER4 : Industry
association’s
encouragement
Industry associations encourages our
organization to protect private information of
the clients, employees etc.,
Y(Tejay and Barton, 2013)
(Liang et al., 2007)
COER5 : Competitive
conditions
Competitive conditions pressurize our
organization to have effective information
privacy practices
Y+
(Tejay and Barton, 2013)
(Johnson, 2009)
(Liang et al., 2007)
Hypotheses development - sample
16
➢ Senior management participation: The participants echoed that the themes related to
– Government, regulatory influence (3)
– Competitive conditions (3) and
– Customer expectations (2)
positively influenced the senior management participation.
➢ Few representative quotes
Sometimes the requirements might come from Senior Management or IT managers (mid-level). We usually need support from Senior
Management, but it’s easy to get support if it’s related to data privacy & security as it’s a “must rule” and “not nice to have”.
- Senior Manager, Medium Scale US Company (MSU-2)
The current organization has invested a lot in privacy & security framework both from Competitive Plus strategic view. Here you might be
competing with competitors who are also playing with same data, but strategic in envisioning what probably data exploitation is in future.
- Information Architect, Large Scale Multi National Company (LSM-1)
➢ Literature: Organizational studies related to security suggest that pressure from regulations will positively
influence investment in information security resources (Cavusoglu et al., 2015)
➢ Hypothesis: Drawing on these findings I posit the following hypothesis
H1a: Coercive forces pertaining to information privacy will positively influence senior management
participation
Hypotheses
17
➢ External forces and their influence on senior management participation
✓ H1a: Coercive forces pertaining to information privacy will positively influence senior management participation
✓ H1b: Normative forces pertaining to information privacy will positively influence senior management participation
✓ H1c: Mimetic forces pertaining to information privacy will positively influence senior management participation
➢ Mediating effects
✓ H2a: Senior management participation has a mediating effect on the relationship between coercive forces and privacy
assimilation
✓ H2b: Senior management participation has a mediating effect on the relationship between normative forces and privacy
assimilation
✓ H2c: Senior management participation has a mediating effect on the relationship between mimetic forces and privacy
assimilation
➢ Moderating effects
✓ H3a: Higher levels of privacy capability in an organization leads to a stronger relationship between coercive forces and
privacy assimilation
✓ H3b: Higher levels of privacy capability in an organization leads to a weaker relationship between mimetic forces and privacy
assimilation
✓ H4a: Higher levels of organizational culture leads to a stronger relationship between mimetic forces and privacy assimilation
✓ H4b: Higher levels of organizational culture leads to a stronger relationship between normative forces and privacy
assimilation
Research model
18
Research model and hypotheses
Organizational Activities
Coercive
Assimilation
(Second Order Formative
Construct :
Business Strategy + Organizational
Activities)
Normative
Mimetic
SMP*
H2a, H2b, H2c
H1a
H1b
H1c
Privacy Capability
Organizational Culture
H3a
H3b
H4a
H4b
* SMP - Senior Management Participation
Business Strategy
Scale development
19
➢ Scale development
✓ Literature search was carried out to identify the measurement items for identified themes to come up with an
instrument
✓ For face validity, the survey instrument was reviewed by seven experts - 5 professionals from the IT industry
and two senior faculty members in the Information System’s area
➢ Pilot study
✓ Duration : Dec 2016 to Jan 2017
✓ 213 responses. 9 cases were dropped due to not meeting the key informant criteria, resulting in194 responses
✓ Sample is a set of graduate students, who after graduation, have an average IT industry experience of 1 year
(minimum 6 months)
➢ Data collection
✓ Duration : Feb 2017 to May 2017
✓ 272 responses, out of which 214 were complete in our sample survey data
✓ Total six (6) cases were dropped for not meeting the key informant criteria, resulting in 208 responses
Link to Descriptive statistics
Measurement model
20
➢ Testing of research model
➢ Partial Least Squares (PLS) based Structural Equation Modelling using SmartPLS software
➢ Validity and reliability through confirmatory factor analysis Link
✓ Measure of the construct (loadings) > 0.6
✓ Composite reliability > 0.8
✓ Average Variance Extracted (AVE) > prescribed minimum value of 0.5
✓ Discriminant Validity
• Correlation values of the items with their own constructs > 0.7
• Values greater than correlation values of other constructs
➢ Assessed common method bias
✓ Harman single-factor test
✓ Common method factor that links to all of the single-indicator constructs that were converted from observed
indicators (Liang et al. 2007)
Results - discussions
21
➢ Institutional forces’ influence on Senior Management Participation (SMP)
➢ Mediating role of Senior Management Participation
*p ≤ 0.1, **p ≤ 0.05 and ***p ≤ 0.001 ✤ VAF - Variance Accounted For
➢ Moderating effects
VariableDirect Effect / Indirect Effect VAF✤
(Indirect /
Total)
SMP
Mediation / CommentsDirect Indirect
COER
(Coercive)Not Significant Significant 96%
Full mediation.
H2a: Supported
NORM
(Normative)Not Significant Significant 90%
Full mediation.
H2b:Supported
MIM
(Mimetic)Significant Significant 26%
Partial mediation
H2c: Not supported
Interaction Effects Comments
COER x PACAP (Coercive x Privacy Capability) H3a : Not supported
MIM x PCAP (Mimetic x Privacy Capability) H3b : Supported
MIM x CULT (Mimetic x Organizational Culture) H4a : Not supported
NORM x CULT (Normative x Organizational Culture) H4b : Supported
Variables Comments
COER (Coercive) H1a supported
NORM (Normative) H1b supported
MIM (Mimetic) H1c supported
Contributions and limitations
22
➢ Contributions
The main contributions of this work:
✓ Developing a theory for information privacy assimilation, building on the concepts derived from neo-institutional
theory using primary data collected through case studies
✓ As information privacy stands out as a distinctly different phenomenon affecting organizations at a strategic level,
this study adds to the body of knowledge pertaining to information privacy
✓ This thesis work tested the relationships identified during theory building phase on a larger sample drawn from
India’s IT industry.
✓ The findings are important for senior managers in understanding the nature of institutional forces, and leverage
them for effective privacy assimilation within IT organizations in the Indian context.
➢ Limitations
✓ The first limitation is the location of the study sample for the Indian context. This might limit the external validity of
our findings
✓ Wider industry samples across the globe can yield more generalizable results
✓ Privacy concepts are dynamic in nature, parallel to evolving culture and perceptions and have to be revisited
periodically
Future directions and conclusion
23
➢ Future directions
✓ Strengthening the scale and instrument development
✓ Administering the survey to large industry samples that include
o Different geographic regions and types of industries.
✓ Multilevel and longitudinal studies
➢ Conclusion
✓ This study produced interesting results useful for theory and management practice - understanding the nature of
forces, tweak the internal influencers for effective privacy assimilation
Privacy vs Security
✓ Pink vs Blue: 2013 IEEE Symposium on Security and Privacy (NITRD Program, 2013)
✓ Plastic vs Other industry dump: Interview with senior executive, Global IT organization
✓ Forgetting & Forgiving are privileges and noble gifts to human beings
Let us not get this human touch undervalued in the computer and Artificial Intelligence era.
Publications
24
International Journals
✓ Attili, V. S. P., S. K. Mathew and V. Sugumaran (2017). Understanding Information Privacy Assimilation in IT Organizations using Multi-Site
Case Studies, Communications of the Association for Information Systems – In Press (Accepted)
International Conferences
✓ Attili, V. S. P., S. K. Mathew and V. Sugumaran (2017, December). Information Privacy Assimilation in IT Organizations: An Empirical
Investigation“. Pre-ICIS Workshop on Information Security and Privacy, Seoul, Korea.
✓ Attili, V. S. P., S. K. Mathew and V. Sugumaran (2017, August). Antecedents of Information Privacy Assimilation in Indian IT Organizations -
An Empirical Investigation. Proceedings of 23rd Americas Conference on Information Systems, Boston, USA.
✓ Attili, V. S. P., S. K. Mathew and V. Sugumaran (2015, August). Information Privacy Assimilation in Organizations - A Neo Institutional
Approach. Proceedings of 21st Americas Conference on Information Systems, Puerto Rico, USA.
✓ Attili, V. S. P and S. K. Mathew (2013, December). Digital Data Privacy in Organizations: A Conceptual Decision Support Framework.
Proceedings of 17th Annual International Conference of the Society of Operations Management, IIT Madras, India.
Industry Forums
✓ Attili, V. S. P and S. K. Mathew (2017, September). Data Privacy Research report presentation. Presentation at ISACA Chapter, Chennai,
India.
✓ Attili, V. S. P and S. K. Mathew (2016, January). Information privacy assimilation Large IT organizations. Presentation at DSCI Chapter -
Data Privacy Day, Infosys Bangalore, India.
✓ Attili, V. S. P and S. K. Mathew (2015, August). Information privacy in our times: How many shades of grey? Presentation at Software
Process Improvement Network (SPIN), Chennai, India.
✓ Attili, V. S. P and S. K. Mathew (2014, December). Data Privacy in the Digital Age: A Research Review. Presentation at International
Computer Security Day, IIT Madras, India.
Work in Progress
✓ Attili, V. S. P and S. K. Mathew (2017). Privacy in IT Organizations: A DSS Framework – In review and resubmit in a leading IS journal
References
25
• Altman, I. (1977). Privacy regulation: culturally universal or culturally specific? Journal of Social Issues, 33(3), 66-84.
• Belanger, F. and R. E. Crossler (2011). Privacy in the digital age: A review of information privacy research in information systems.
MIS Quarterly, 35(4), 1017-1042.
• Bennett, C. J. (1995). The political economy of privacy: a review of the literature. Center for social and legal research, DOE genome
project, University of Victoria, Department of Political Science, Victoria.
• Cavusoglu, H., H. Cavusoglu, J.-Y. Son and I. Benbasat (2015). Institutional pressures in security management: Direct and indirect
influences on organizational investment in information security control resources. Information & Management, 52(4), 385-400.
• Chan, Y. E., M. J. Culnan, K. Greenaway, G. Laden, T. Levin and H. J. Smith (2005). Information privacy: Management,
marketplace, and legal challenges. Communications of the Association for Information Systems, 16(1), 270-298.
• Clearinghouse (2017). Privacy data breaches. Retrieved from https://www.privacyrights.org/data-breach (Date of retrieval : 8-Nov-
2017)
• Culnan, M. J. and C. C. Williams (2009). How ethics can enhance organizational privacy: Lessons from the choicepoint and TJX
data breaches. MIS Quarterly, 33(4), 673-687.
• Davis, J. P. and K. M. Eisenhardt (2011). Rotating leadership and collaborative innovation recombination processes in symbiotic
relationships. Administrative Science Quarterly, 56(2), 159-201.
• DiMaggio, P. and W. W. Powell (1982). The iron cage revisited: Conformity and diversity in organizational fields (Vol. 52): Institution
for Social and Policy Studies, Yale University.
• DiMaggio, P. and W. W. Powell (1991). The new institutionalism in organizational analysis (Vol. 17): University of Chicago Press
Chicago, IL.
References
26
• Eisenhardt, K. M. (1989). Building theories from case study research. Academy of Management Review, 14(4), 532-550.
• Ernst & Young (2015). Creating trust in the digital world: EY’s global information security survey. Retrieved from
http://www.ey.com/Publication/vwLUAssets/ey-global-information-security-survey-2015/$FILE/ey-global-information-security-
survey-2015.pdf (Date of retrieval : 8-Nov-2017)
• Greenaway, K. E., Y. E. Chan and R. E. Crossler (2015). Company information privacy orientation: A conceptual framework.
Information Systems Journal, 25(6), 579-606.
• Hair Jr, J. F., G. T. M. Hult, C. Ringle and M. Sarstedt (2016). A primer on partial least squares structural equation modeling
(PLS-SEM): Sage Publications.
• Holsti, O. R. (1969). Content analysis for the social sciences and humanities. Reading, MA: Longman Higher Education.
• Hsu, C., J.-N. Lee and D. W. Straub (2012). Institutional influences on information systems security innovations. Information
Systems Research, 23(3-part-2), 918-939.
• Liang, H., N. Saraf, Q. Hu and Y. Xue (2007). Assimilation of enterprise systems: The effect of institutional pressures and the
mediating role of top management. MIS Quarterly, 31(1), 59-87.
• Powell, W. W. and P. J. DiMaggio (Eds.) (2012). The new institutionalism in organizational analysis. University of Chicago
Press.
• Tejay, G. P. and K. A. Barton (2013). Information system security commitment: A pilot study of external influences on senior
management. In Proceedings of 46th Hawaii International Conference the System Sciences (HICSS).
• Warren, S. D. and L. D. Brandeis (1890). The right to privacy. Harvard law review, 193-220.
• Westin, A. F. (2003). Social and political dimensions of privacy. Journal of Social Issues, 59(2), 431-453.
© 2017 Infosys Limited, Bengaluru, India. All Rights Reserved. Infosys believes the information in this document is accurate as of its publication date; such information is subject to change without notice. Infosys acknowledges the proprietary rights of other
companies to the trademarks, product names and such other intellectual property rights mentioned in this document. Except as expressly permitted, neither this documentation nor any part of it may be reproduced, stored in a retrieval system, or transmitted in
any form or by any means, electronic, mechanical, printing,photocopying, recording or otherwise, without the prior permission of Infosys Limited and/ or any named intellectual property rights holders under this document.
Thank You