IEEE Technology and Society Magazine - March 2022 - 60

Feature
[65] describes South Korean approach (PIPA 2011)
as innovative and transparent, whereas Taiwan's
approach (PDPA 2010 and Enforcement Rules)
is comprehensive but with limited evidence of
enforcement efficacy at the time of publication.6
In contrast, despite the apparent comprehensiveness
of a data protection law developed in the
Philippines (Data Privacy Act 2012) that ostensibly
has a number of features similar to the European
Union, Greenleaf [65] describes the approach as
ultimately ambiguous, unimplemented, and lacking
measures for systematic enforcement concluding
that it as window dressing. Thus, ICS professionals
must consider both the formal regulation and the
informal social norms and conventions of a society
and community.
Attitudes toward privacy and security
technologies
Beyond the academic and legal definitions of
privacy, subjective beliefs concerning privacy and
security must also be considered during the design
process. At a granular level, privacy concerns are a
frequent topic of international surveys. In a Canadian
survey conducted by the Privacy Commissioner
of Canada in 2016, 57% of Canadians surveyed
expressed concern about personal information protection.
Within the United Kingdom, a survey conducted
by the Information Commissioner's Office
found that only 27% of respondents had high trust in
how organizations used their information. They also
noted that the reason for this lack of trust stemmed
from a variety of concerns including " data hacking "
(16%), data leaks/breaches (13%), data misuse
(12%), and security (9%). Although each of these
issues can be classified as a violation of user trust,
these observations require qualification.
Insights can also be drawn by examining attitudes
toward homeland security systems. Sanquist et al.
[66] had participant rate attributes that would attenuate
or amplified risk perception. Despite the increase
in acceptance of these technologies based on their
perceived accuracy, validity, control, and transparency,
rejection of these technologies stemmed from
perceived threats to privacy, including disclosure,
embarrassment, intrusion, rights, as well as threats
that compromise financial information.
6It is crucial to note here that these policies have been updated (e.g., Taiwan's PDPA
2015), with Greenleaf's work reflecting a recent, historical account.
Research on cyber hygiene practices provides
insights into the extent to which individuals are sensitive
and vulnerable to threats. In recent years, scales
have been developed to assess cyber hygiene behavior
[67]. Some of these studies have suggested that
relationships exist between cyber hygiene practices
and personality traits, for example, conscientiousness
appears to be related to changing passwords
and updating software [68]. In research examining
unintentional insider threat detection, Schoenherr
[69] found that individuals high in the emotionality
facet of fear were more likely to disclose information
on social media, whereas those high in the facet of
anxiety were less likely to engage in behaviors that
would make them susceptible to intrusion, for example,
using public WiFi, download files from unknown
sources. Thus, personality differences are likely to
relate to the extent that individuals are aware and
make themselves more susceptible to loss of privacy
and security.
Socioeconomic and cultural differences
Rho et al. [70] provided respondents from numerous
countries with a security and privacy questionnaires.
Crucially, they found that individuals from
countries with higher GDPs expressed more privacy
concerns than those from countries with lower
GDPs. How this result should be interpreted remains
an open question given the factors correlated with
GDP. For instance, respondents from countries with
higher GDP might have greater exposure to technology
and have more experience considering privacy
and security issues. Concomitantly, these respondents
might also have a greater exposure to risk
given their embeddedness within a sociotechnical
system (e.g., datafication of personal information,
use of IoT devices). Finally, individuals from high
GDP countries might perceive themselves as having
higher status and disinclined to share information
due to the comparative lose if their information
is compromised.
Using methods developed by Milberg et al. [62],
Bellman et al. [79] attempted to differentiate the
sources of privacy concerns in terms of individual
experiences, social norms, and political institutions.
In addition to cultural values, they found that the
most important determinant of privacy concerns
was individual experience. Similar results were also
obtained by Cullen [71]. In a study that compared
Japanese and New Zealander respondents, she
60
IEEE Technology and Society Magazine
IEEE Technology and Society Magazine - March 2022

Table of Contents for the Digital Edition of IEEE Technology and Society Magazine - March 2022
