Uninformed Consent: The Benefits and Limits of Transparency and Choice in Privacy Decision Making

<p>Solutions to privacy concerns centered on notifying consumers about (transparency), and granting them control over the collection and use of their personal information (choice) are pervasive. Policy makers posit that these measures will aid consumers in improved privacy decision making. Conversely, scholars argue that these protections may have a negative impact on market efficiency and firm technology innovation and adoption. Chapter 2 evaluates the impact of regulation providing consumers transparency and choice on technology adoption by hospitals and finds, in contrast to prior results, evidence for a beneficial role of privacy regulation. I also find evidence that these gains may be a result of reduced barriers to adoption stemming from consumer privacy concerns. In Chapters 3 and 4 I shift my focus to evaluate the premise proposed by policy makers that increased transparency and choice will improve consumer privacy decision making. In Chapter 3, I first find that simple privacy notices communicating lower privacy decision making. I Chapter 3, I first find that simple privacy notices communication lower privacy protection can, under some conditions, result in less disclosure from participants, in-line with the policy aims for increased transparency. However, I also find that simple and common changes in those same notices, exploiting individual heuristics and biases, can result in the effect of even straightforward and accessible privacy notices being predictably manipulated (Experiment 1) or entirely thwarted (Experiment 2). Finally, in chapter 4 I find substantial malleability in individual privacy decision making in response to changes in choice framing. Specifically, the labeling of settings, the mix of setting relevance, and the presentation of choices as a choice to reject all impacted the decision frame for participants in a manner that significantly influenced participants' choice of privacy protective settings. Taken together, these results suggest that while privacy solutions centered on transparency and choice may alleviate barriers to technology adoption stemming from consumer privacy concerns, the implicit assumption that they will reduce consumer privacy risks may be questioned. Implications for policy makers include a persistence, and perhaps increase, in consumer privacy risks despite increased transparency and control. </p

Impact of Health Disclosure Laws on Health Information Exchanges

Health information exchanges (HIEs) are expected to facilitate collaboration between healthcare entities and improve efficiency and quality of care through enhanced information sharing capabilities. Privacy concerns have been consistently cited as one of the primary challenges to HIE development and adoption. Currently, it is unclear how privacy laws – in particular, legislation restricting the disclosure of health records – have impacted the adoption of HIEs intended to facilitate sharing of health information. This study explores the landscape of health privacy legislation at the State level and examines the impact of variations in such privacy and confidentiality laws across the United States on the progress of HIEs.</p

Your Location has been Shared 5,398 Times! A Field Study on Mobile App Privacy Nudging (CMU-ISR-14-116)

<p>Smartphone users are often unaware of the data collected by apps running on their devices. We report on a study that evaluates the benefits of giving users an app permission manager and of sending them nudges intended to raise their awareness of the data collected by their apps. Our study provides both qualitative and quantitative evidence that these approaches are complementary and can each play a significant role in empowering users to more effectively control their privacy. For instance, even after a week with access to the permission manager, participants benefited from nudges showing them how often some of their sensitive data was being accessed by apps, with 95% of participants reassessing their permissions, and 58% of them further restricting some of their permissions. We discuss how participants interacted both with the permission manager and the privacy nudges, analyze the effectiveness of both solutions and derive some recommendations.</p