Privacy and Informed Consent in Online Interactions: Evidence from Expert Focus Groups

This paper draws on evidence from a series of expert focus groups to question the function of “informed consent” in online transactions. Informed consent and related concepts have a key role in much privacy research and are an integral part of much data protection legislation. The research methodology used in this paper was focus groups with expert participants and the paper describes this approach in detail. Four expert groups, with participants from civil society organizations, data protection professionals, public sector organizations and small and medium sized enterprises (SMEs) took part in the focus groups which ran for a total of 10 hours. This paper reports on the results from the focus groups in terms of a) privacy policies, b) control over the use of personal data, c) consent as a response to regulatory requirements and d) the nature of informed consent. The evidence from the focus groups questions the extent to which informed consent operates in online interactions. This suggests a number of novel research directions that arise from the analysis. The paper ends by suggesting alternative ways of addressing “informed consent” in online interactions.

[1]  Ritu Agarwal,et al.  Adoption of Electronic Health Records in the Presence of Privacy Concerns: The Elaboration Likelihood Model and Individual Persuasion , 2009, MIS Q..

[2]  H. Jeff Smith,et al.  Information Privacy: Measuring Individuals' Concerns About Organizational Practices , 1996, MIS Q..

[3]  R. Priest.  Data Protection Act , 1988 .

[4]  Paul De Hert,et al.  Identity management of e-ID, privacy and security in Europe. A human rights view , 2008, Inf. Secur. Tech. Rep..

[5]  Nikolajs Zeps,et al.  Waiver of individual patient consent in research: when do potential benefits to the community outweigh private rights? , 2007, The Medical journal of Australia.

[6]  S. Eckstein.  Ethical principles for medical research involving human subjects. , 2001, European journal of emergency medicine : official journal of the European Society for Emergency Medicine.

[7]  Edgar A. Whitley,et al.  Informational privacy, consent and the "control" of personal data , 2009, Inf. Secur. Tech. Rep..

[8]  Alan R. Hevner,et al.  Focus Groups for Artifact Refinement and Evaluation in Design Research , 2010, Commun. Assoc. Inf. Syst..

[9]  Val Collins,et al.  Privacy in the United Kingdom: a Right Conferred by Europe? , 1993, Int. J. Law Inf. Technol..

[10]  T. Wilkinson,et al.  Research, informed consent, and the limits of disclosure. , 2001, Bioethics.

[11]  Richard A. Krueger,et al.  Quality Control in Focus Group Research , 1993 .

[12]  R. Barbour.  Introducing Focus Groups , 2007 .

[13]  L. Hart,et al.  The Impact of Context on Data , 1999 .

[14]  P. Lunt,et al.  Privacy versus willingness to disclose in e-commerce exchanges: The effect of risk awareness on the relative role of trust and control , 2004 .

[15]  Janet Mancini Billson,et al.  Focus Groups: A Practical Guide for Applied Research , 1989 .

[16]  J. Turow,et al.  How Different are Young Adults from Older Adults When it Comes to Information Privacy Attitudes and Policies? , 2010 .

[17]  J. W. DeCew.  In Pursuit of Privacy: Law, Ethics, and the Rise of Technology , 1997 .

[18]  Sung S. Kim,et al.  Internet Users' Information Privacy-Protective Responses: A Taxonomy and a Nomological Model , 2008, MIS Q..

[19]  J. Knodel,et al.  The Design and Analysis of Focus Group Studies: A Practical Approach , 1993 .

[20]  Ellen Perecman,et al.  A Handbook for Social Science Field Research: Essays & Bibliographic Sources on Research Design and Methods , 2006 .

[21]  P. Pavlou,et al.  Consumer Acceptance of Electronic Commerce: Integrating Trust and Risk with the Technology Acceptance Model , 2003 .

[22]  John C Moskop,et al.  Information Disclosure and Consent: Patient Preferences and Provider Responsibilities , 2007, The American journal of bioethics : AJOB.

[23]  Paul A. Pavlou,et al.  Understanding and Mitigating Uncertainty in Online Exchange Relationships: A Principal-Agent Perspective , 2007, MIS Q..

[24]  Robert M Veatch,et al.  Implied, Presumed and Waived Consent: The Relative Moral Wrongs of Under- and Over-Informing , 2007, The American journal of bioethics : AJOB.

[25]  D. Morgan.  Successful Focus Groups: Advancing the State of the Art , 1993 .

[26]  Lorrie Faith Cranor,et al.  Standardizing privacy notices: an online study of the nutrition label approach , 2010, CHI.

[27]  Mary J. Culnan,et al.  "How Did They Get My Name?": An Exploratory Investigation of Consumer Attitudes Toward Secondary Information Use , 1993, MIS Q..

[28]  Irene Pollach.  A Typology of Communicative Strategies in Online Privacy Policies: Ethics, Power and Informed Consent , 2005 .

[29]  Makoto Yokofujita,et al.  [Law and medical ethics]. , 2004, Nihon Hoshasen Gijutsu Gakkai zasshi.

[30]  Uwe Flick,et al.  Designing Qualitative Research , 2008 .

[31]  J. Law,et al.  Complexities: Social Studies of Knowledge Practices , 2002 .

[32]  Klaus Hoeyer,et al.  Informed Consent: The Making of a Ubiquitous Rule in Medical Practice , 2009 .

[33]  Alessandro Acquisti,et al.  The Effect of Online Privacy Information on Purchasing Behavior: An Experimental Study , 2011, WEIS.

[34]  Hock-Hai Teo,et al.  The Value of Privacy Assurance: An Exploratory Field Experiment , 2007, MIS Q..

[35]  J. Kitzinger.  The methodology of focus groups: the importance of interaction between research participants , 1994 .

[36]  M. Culnan,et al.  Information Privacy Concerns, Procedural Fairness, and Impersonal Trust: An Empirical Investigation , 1999 .

[37]  Malcolm Williams.  Making Sense of Social Research , 2002 .

[38]  L. Bygrave.  Data Protection Law, Approaching Its Rationale, Logic and Limits , 2002 .

[39]  Sandra J. Milberg,et al.  Information Privacy: Corporate Management and National Regulation , 2000 .

[40]  G. M. Johnson,et al.  Understanding Communication Processes in Focus Groups , 1993 .

[41]  Cathy Urquhart,et al.  Putting the ‘theory’ back into grounded theory: guidelines for grounded theory studies in information systems , 2009, Inf. Syst. J..

[42]  Jane Frankland,et al.  Some issues arising in the systematic analysis of focus group materials. , 1998 .

[43]  Paul A. Pavlou,et al.  Consumer Acceptance of Electronic Commerce: Integrating Trust and Risk with the Technology Acceptance Model , 2003, Int. J. Electron. Commer..

[44]  J. Rubenfeld.  The Right of Privacy , 1989 .

[45]  Mayuram S. Krishnan,et al.  The Personalization Privacy Paradox: An Empirical Evaluation of Information Transparency and the Willingness to be Profiled Online for Personalization , 2006, MIS Q..

[46]  Norman A. Johnson,et al.  Personality traits and concern for privacy: an empirical study in the context of location-based services , 2008, Eur. J. Inf. Syst..

[47]  Ian R. Kerr,et al.  Lessons from the Identity Trail: Anonymity, Privacy and Identity in a Networked Society , 2009 .

[48]  Ross Anderson,et al.  Database State: A Report Commissioned by the Joseph Rowntree Reform Trust Ltd. , 2009 .

[49]  Donna L. Hoffman,et al.  Information Privacy in the Marketspace: Implications for the Commercial Uses of Anonymity on the Web , 1999, Inf. Soc..

[50]  J. Kitzinger,et al.  Qualitative Research: Introducing focus groups , 1995 .

[51]  R. Petty.  Marketing without Consent: Consumer Choice and Costs, Privacy, and Public Policy , 2000 .

[52]  Neal Devins,et al.  Reflections on Coercing Privacy , 1999 .

[53]  K. Eisenhardt.  Building theories from case study research , 1989, STUDI ORGANIZZATIVI.

[54]  Edward F. Fern.  The use of Focus Groups for Idea Generation: The Effects of Group Size, Acquaintanceship, and Moderator on Response Quantity and Quality , 1982 .

[55]  Ben Light,et al.  More Than Just Friends? Facebook, Disclosive Ethics and the Morality of Technology , 2008, ICIS.

[56]  Lucas D. Introna.  Privacy and the computer: why we need privacy in the information society , 1997 .

[57]  Jane Kaye,et al.  Revoking consent: A 'blind spot' in data protection law? , 2010, Comput. Law Secur. Rev..

[58]  T. M. Williamson.  Research, Informed Consent, and the Limits of Disclosure , 2001 .

[59]  Naresh K. Malhotra,et al.  Internet Users' Information Privacy Concerns (IUIPC): The Construct, the Scale, and a Causal Model , 2004, Inf. Syst. Res..

[60]  Betsy Masiello,et al.  Opt-in dystopias , 2010 .

[61]  Varun Grover,et al.  The Effect of an IS Article's Structure on Its Impact , 2010, Commun. Assoc. Inf. Syst..

[62]  Christopher Kuner,et al.  European Data Privacy Law and Online Business , 2003 .

[63]  Mary J. Culnan,et al.  How Ethics Can Enhance Organizational Privacy: Lessons from the ChoicePoint and TJX Data Breaches , 2009, MIS Q..

[64]  Mike Chiasson,et al.  If fair information principles are the answer, what was the question? An actor-network theory investigation of the modern constitution of privacy , 2005, Inf. Organ..