Communication of Information Privacy Practices in Consumer Information Systems

At the beginning of the 21th century, we live in a globally connected world with nearly ubiquitous information collection and ever-intensifying information privacy risks. This cumulative thesis substantiates approaches for information privacy risk reduction through organizational information privacy communication. Organizational information privacy communication has been addressed by two dominant literature streams; one promotes overarching principles and guidelines too vague to improve information privacy communication to a degree much higher than punishing the worst offenders; the other provides too many technical solutions for too narrow problems. This thesis contributes to bridging the gap between the normative and empirical information privacy world by answering the research question: How could consumer information system components be designed to communicate organizational information privacy practices to consumers in a substantive way? The employed research approach is mixed-methods and retroductive. It first clarifies the problem space by consolidating extant knowledge in research and practice, proceeds with development of a potential solution space in form of an information systems design theory, and concludes by substantiating the core underlying assumption of the proposed theory—the heterogeneity of consumers’ information privacy information needs—with an online survey. ... mehrThe contested and complex nature of information privacy makes it unlikely that organizations can satisfy consumers with a universal solution. This thesis addresses this problem by proposing a flexible, adaptive approach to organizational information privacy communication and by establishing a scientific foundation that supports entities striving to improve organizational information privacy communication to assess how to approach the challenge, to grasp the resource requirements, and to avoid sunk costs. Even if substantive organizational information privacy communication is never transformed from normative prescription into empirical reality, this work will serve as scientific foundation to investigate whether and why substantive organizational information privacy communication is not realized in practice and why it may not be socially desirable. Complementing extant normative guidance with a thorough understanding of consumers’ information privacy information needs and an information systems design theory may just be the missing impulse for the emergence of truly useful and substantive organizational information privacy communication in consumer information systems.