Exploring the dimensions of individual privacy concerns in relation to the Internet of Things use situations
| Pages | 528-544 |
| Published date | 10 September 2018 |
| DOI | https://doi.org/10.1108/DPRG-05-2018-0023 |
| Date | 10 September 2018 |
| Author | Ali Padyab,Anna Ståhlbröst |
| Subject Matter | Information & knowledge management,Information management & governance,Information policy |
Exploring the dimensions of individual
privacy concerns in relation to the Internet
of Things use situations
Ali Padyab and Anna Ståhlbröst
Abstract
Purpose –The integration of internetof things (IoT) devices into daily life introduceschallenges for the
privacy of their users and those who areaffected by these devices. This paper explores the factors that
affect individual concerns regarding IoT use and how those factors affect the dynamics of privacy
managementwith the presence of an IoT device.
Design/methodology/approach –Four focus groups of individuals and IoT experts were studied to
understand the groups’ privacy concerns. The authors adopted a qualitative research metho d
based on grounded theory to find relevant dimensions of situa tional privacy concerns in IoT use
situations.
Findings –The results revealed that fourteen dimensions of individuals’ privac y concerns regarding
the IoT are relevant and can be categorized under four key influential factors: collection, IoT device,
collected data storage and use ofcollected data. The authors also analyzed the focus groups using
genres of disclosure theory and explored how privacy concerns affect individual privacy
management regulations.
Research limitations/implications –This paper contributesto how future research can employgenres
of disclosureas a theoretical framework to identify situationswhere privacy violations occur.
Practical implications –This study can assist service providers and IoT manufacturers in deriving
designprinciples and decreasing concerns by addressingthe information that must be communicatedto
their users.
Originality/value –As opposed to the previous research, which was more inclined to dispositional
privacy concerns, this study provides insights into situational privacy concerns when individuals are
confronted with the IoT. This study represents the first attempt to investigate the process individuals
experiencein managing their privacy.
Keywords Internet of things, Privacy concern, Genre of disclosure, Individual privacy,
Situational privacy concern
Paper type Research paper
1. Introduction
Internet of things (IoT) devices are networks of smart things that enable people and objects
to be connected through the internet infrastructure. The increasing availability and diversity
of the IoT enable a society in which all members haveaccess to internet services, which are
populated by self-configuring, self-managing smart technology anytime and anywhere
(Atzori et al.,2010). These devices enable data collection from the surrounding human
environment to provide useful services for individuals, such as energy savings, security,
home automation, transportation, wellness and many more in the future. Similarto any other
technology, the application of the IoT has disadvantages. The collection of data about
individuals exposes them to possible violations of privacy, which can make the adoption of
IoT devices a challenging task (Dutton, 2014;Gubbi et al.,2013). Perpetual collection of
Ali Padyab is a PhD student
at the Department of
Computer Science,
Electrical and Space
Engineering, Lulea
˚
University of Technology,
Lulea
˚, Sweden.
Anna Sta
˚hlbro
¨st is a
Professor at the
Department of Computer
Science, Electrical and
Space Engineering, Lulea
˚
University of Technology,
Lulea
˚, Sweden.
Received 20 February 2018
Revised 11 May 2018
25 June 2018
Accepted 7 July 2018
This work was funded by the
European Commission in the
context of the Horizon 2020
project U4IoT (Grant
Agreement No. 732078) and
the Horizon 2020 project
PrivacyFlag (Grant Agreement
No. 653426), which are
gratefully acknowledged.
PAGE 528 jDIGITAL POLICY, REGULATION AND GOVERNANCE jVOL. 20 NO. 6 2018, pp. 528-544, ©Emerald Publishing Limited, ISSN 2398-5038 DOI 10.1108/DPRG-05-2018-0023
people’s data enables one to track the actions and behavior of the users and derive
sensitive information about individuals, which is not only utilized by the technology itself but
also by third parties such as businesses,hackers and governments.
The absence of privacy protectionhas been shown to be an influencing factor regarding the
acceptance and adoption of the IoT (Chow et al.,2015;Hsu and Lin, 2016). Increasingly,
many people are becoming vigilant about their interaction with IoT devices, particularly
because of recent media coverage about the CIA’s program (i.e. Vault7) that turns some
IoT-enabled devices into surveillancetools (Coldewey, 2017). This situation is compounded
by the fact that the IoT users are not notified when potentially sensitive information is
collected, and there is no user interface to specify the privacy preferences for the services
(Lee and Kobsa, 2016).
Despite the importance of the developments in the field of the IoT, researchers know little
about individuals’ thoughts and feelings about privacy in regards to the IoT. The research
on privacy concerns from individuals’ perspectives of the IoT is limited to privacy concerns
from the viewpoint of IoT experts (Virkki and Chen, 2013), coarsely defined contexts (Lee
and Kobsa, 2016) or affecting factors that researchers borrow from other research areas
such as e-commerce (Kowatsch and Maass, 2012). Compared to e-commerce, where the
users have some control over informationdisclosure, IoT devices unobtrusively collect data.
Additionally, previous studies on the IoT have focused on dispositional privacy concerns
(Malhotra et al., 2004;Smith et al.,1996). However, there is growing support from recent
studies that demonstrate that privacy concerns are also situational and context-specific
(Kayhan and Davis, 2016;Li, 2011;Sim et al.,2012). The focus of this research is to
understand these situational privacy concerns in the IoT because situational privacy
concerns shape an individual’s decision of how to behave or regulate to manage their
privacy (Glover and Benbasat, 2010). Thus, to maximize the potential of the IoT, it is
important to understand the privacy concerns of individuals who are not only users but also
non-users (i.e. affected by such devicesor “affectees”).
The purpose of this study is to explore affectees’ and users’ perceptions of privacy
concerns regarding IoT use situations. A bottom-up approach for IoT policymaking,
research and service design allows policymakers and practitioners to account for
individual’s concerns in relation to their needs (Melis et al., 2016;Shin and Park, 2017).
However, individuals’ perspectives have been largely absent in the IoT privacy
research. Thus, the research questions that guide this study are the following. RQ1:
What are the dimensions of situational privacy concerns in the IoT? RQ2: What is the
interplay between the dimensions of privacy concerns and an individual’s privacy
management? To fulfill this goal, we conducted four focus groups (FGs) with 16
individuals. An inductive qualitative analysis was adopted to identify the relevant
dimensions of individual privacy concerns particular to the IoT. We applied genres of
disclosure (Palen and Dourish, 2003) as an interpretive lens to explore the development
of situational privacy concerns in IoT use situations. We posit that this study is the first
step to discover the situational privacy concerns in the IoT, which will help future
researchers to theorize about privacy threats and individuals’ reactions to them. From a
practical perspective, this study enables service providers and policymakers to be
proactive in mitigating privacy concerns that affect users’ decisions and increase
users’ adoption of IoT services.
The remainder of the paper is arranged as follows. First, an overview of user privacy
concerns in the field of the IoT and the research gaps are presented. In Section 3, we
introduce the genres of disclosure theory as our theoretical framework. Then, the
research process through four FG sessions is described, and the findings of the study
are presented. Finally, the contributions and implications of the research findings are
discussed.
VOL. 20 NO. 6 2018 jDIGITAL POLICY, REGULATION AND GOVERNANCE jPAGE 529
To continue reading
Request your trial