IEEE Technology and Society Magazine - March 2022 - 59

that adopted contact tracing mobile phone applications
during the COVID-19 pandemic had higher
levels of cultural tightness compared to those that
did not.
If cultural tightness promotes the adoption of surveillance
technology more generally, it has implications
for cybersecurity, with groups that are higher
in cultural tightness being more likely to endorse
cybersecurity measures and a greater likelihood
of adhering to cyber hygiene practices if they are
endorsed by the community. For instance, another
individual difference within psychological science is
the notion of social dominance orientation, or SDO
[61]. Individuals high in SDO are more inclined to
reject social reforms and endorse practices that preserve
the structure of a group. For instance, across a
number of experiments, Pratto et al. [61] found that
individuals high in SDO were more likely to have jobs
associated with the law, law enforcement, politics,
and business. Those high in SDO also reported lower
levels of tolerance and greater support for military
programs and law and order. Consequently, social
groups that are defined by, or benefit from, a social
structure are more likely to endorse the adoption of
cybersecurity technologies. However, research is
required to define the nature of this relationship.
Social and legal frameworks
In addition to cultural traditions, top-down influences
such as legislation and organizational policies
also reflect a critical feature of the sociotechnical
systems of cybersecurity and surveillance. To
accommodate the varied sociolegal privacy infrastructure,
Milberg et al. [62] introduced the idea
of a continuum of governmental involvement in
organizational privacy management. Defined by the
highest degree of control, a licensing model requires
that data controllers must receive a license from governmental
organizations that specify standards for
the collection, storage, use, and reuse of information
retained from data subjects. In contrast, a self-help
model is defined by the lowest degree of external
control, such that data subjects assume the responsibility
of monitoring the use of their information
and the appropriateness of policies and practices.
In between these two poles, intermediate degrees of
control are evidenced in terms data commissioners
that cannot directly regulate privacy-related activities
but can monitor and investigate concerns raised
by citizens.
March 2022
National and international policy frameworks
Milberg et al.'s model can also be extended to
accommodate the existence of standards developed
by international organizations [e.g., African Union
(AU) or European Union (EU)], by assuming a twotier
model, where the implementation of general
standards or principles are left to the member nations
(decentralization) or establishing a dedicated body
for monitoring and regulating compliance with these
standards (centralization).
Regional, national, and international policies
have adopted a diverse set of approaches that vary
in terms of their content and comprehensiveness.
For instance, the AU Conventions on Cyber Security
and Personal Data Protection notes that " the
protection of personal data ... requires a balance
between the use of information and communication
technologies and the protection of the privacy
of citizens in their daily or professional lives, while
guaranteeing the free flow of information " (p. 2).
However, the Conventions does not define privacy.5
In fact, Abdulrauf [63] notes that since the adoption
of this convention, " nothing else has been
done by the [AU] to signify its seriousness in this
increasingly sensitive and crucial field of law, " and
that this is especially concerning given that " Africa
is home to some of the most pervasive surveillance
programs and data mining activities " (p. 88; for a
more comprehensive review of AU member state
policies, see [64]).
In contrast, the EU's General Data Protection
Regulation (GDPR) provides greater guidance and
specificity in terms of how data subjects information
is stored and used. As with the AU, member
states (e.g., France and Germany) are left to implement
these shared principles. As a former member
of the European Union, the United Kingdom has
developed and retained similar principles. Regional
implementation frameworks are also evidenced
within North American (e.g., Alberta, British Columbia,
and Québec within Canada; California in the
United States) that apply to data holders that operate
within these provinces and states.
Similarly, the diversity of data privacy laws within
Asian-Pacific countries also represents a disaggregated
approach. For instance, in a wide-ranging
review of policies conducted in 2014, Greenleaf
5In this case, it should be noted that the conventions are meant to be general.
However, this does raise concerns over potential difference that might arise within
specific nations.
59
IEEE Technology and Society Magazine - March 2022

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2022
