How Internet Users' Privacy Concerns Have Evolved Since 2002
Total Page:16
File Type:pdf, Size:1020Kb
Internet Privacy How Internet Users’ Privacy Concerns Have Evolved since 2002 A 2008 survey revealed that US Internet users’ top three privacy concerns haven’t changed since 2002, but privacy-related events might have influenced their level of concern within certain categories. The authors describe their results as well as the differences in privacy concerns between US and international respondents. nderstanding and protecting personal privacy pliance date occurred after our in information systems is becoming increas- first survey but before the second; ingly critical with widespread use of net- consequently, people may be more aware of privacy Annie i. worked systems and the Internet. In 2002, we notices today than in 2002 for a variety of reasons. For Antón, Ucreated and validated a survey instrument to establish a example, consider that after the 2003 HIPAA com- JuliA B. eArp, baseline of Internet users’ privacy concerns.1 We devel- pliance date, anyone who visited a healthcare facility And JessicA d. oped this instrument by using a subset of the Antón and started receiving privacy notices and was required to Young Earp privacy goal taxonomy2 to express dimensions of sign a statement indicating that they had received or North privacy concerns such as access/participation, informa- read that organization’s privacy notice. Carolina State tion collection, information storage, information trans- The economic and legal landscape has also changed University fer, notice/awareness, and personalization. over the six years between our first and second sur- The 2002 survey revealed that Internet users were veys. Consider the US Census Bureau data that shows primarily concerned about information transfer, an increase in US e-commerce retail sales from $10.2 notice/awareness, and information storage. We also billion during the second quarter of 2002 to $31.6 bil- learned that users’ privacy concerns did not align with lion during the third quarter of 2008 (www.census. online privacy policies because the latter primarily gov/mrts/www/ecomm.html). Clearly, this increase emphasized data integrity/security, information col- in online shopping suggests that Internet users might lection, and user choice/consent. Thus, we found be more comfortable sharing their sensitive financial no overlap between the top three privacy concerns information (such as credit-card numbers) with Web among Internet users and the items most emphasized sites than they were six years ago. in Internet privacy policies. In 2008, we repeated our Professional and social networking sites that let survey to determine whether and how users’ privacy individuals connect with coworkers, friends, fam- interests have evolved in the six intervening years. ily, classmates, and others online have seen a similar jump in usage since 2002. LinkedIn, a professional Then and Now networking site founded in May 2003, had 33 mil- Many privacy-related events have occurred since lion users by October 2008 (http://press.linkedin. 2002, prompting us to examine whether individuals’ com/history). MySpace, founded in late 2003, had privacy concerns have evolved. We quickly learned 110 million active users by January 2008 (www.web that this also entailed considering how the environ- -strategist.com/blog/2008/01/09/social-network ment has evolved as well. For example, the US Con- -stats-facebook-myspace-reunion-jan-2008/), and gress enacted the Health Insurance Portability and Facebook, launched in February 2004, had more Accountability Act (HIPAA) in 1996 but did not than 100 million active users by August 2008 (www. require compliance until 2003. Therefore, the com- facebook.com/press/info.php?timeline). These num- JANUARY/FEBRUARY 2010 ■ 1540-7993/10/$26.00 © 2010 IEEE ■ COPUBLISHED BY THE IEEE COMPUTER AND RELIABILITY SOCIETIES 21 Internet Privacy Reported data loss events Breach notication laws effective 2000 2001 2002 2003 2004 2005 2006 2007 2008 Figure 1. Breach notification laws and reported data loss events. Blue diamonds represent individual data loss events and red squares represent the effective date for the different state-based data breach notification laws. The gray vertical bars mark the times during which we conducted our surveys in 2002 and 2008. We generated this figure from http://datalossdb.org using data accessed on 20 April 2009. bers indicate that people increasingly feel comfortable using data from the Open Security Foundation’s Data- putting varied information about themselves online. LossDB (http://datalossdb.org), which appears to be Individuals also appear more willing to speak the most comprehensive list of data loss events avail- out about what they perceive as invasions of privacy able (www.privacyrights.org/ar/ChronDataBreaches. when engaging in online activities. For example, in htm). The database had only 16 reported events before February 2009, Facebook changed its Terms of Ser- 2002, with no events reported during the course of vice regarding its information practices, resulting in our first survey. In contrast, at the start of the second a public outcry from its members that manifested in survey, the database contained 1,370 reported events, the creation of Facebook user groups protesting the and 47 additional events occurred during its course. change. In response to this outcry, Facebook reverted In response to concerns about the need to notify back to its previous terms while crafting a new version individuals about compromises of their sensitive in- that reduced the problematic verbiage (http://blog. formation, states are passing data breach notification facebook.com/blog.php?post=54746167130). laws. In fact, as of this writing, Alabama, Kentucky, Along with the increase in online shopping and Mississippi, Missouri, New Mexico, and South Da- professional/social networking, the number of con- kota are the only US states without such laws, which sumer complaints about information practices has also vary by state but require companies to notify consum- risen. The US Federal Trade Commission’s (FTC’s) ers when breaches involve their personal information. Consumer Sentinel Network has an online database California was the first state to have a data breach no- of consumer complaints addressing, for example, tification law, which became effective on 1 July 2003; fraud and identity theft (www.ftc.gov/sentinel). To the next wave of notification laws came two years better understand complaint trends, we examined the later, in 2005. Figure 1 chronologically plots reported Consumer Sentinel Network Data Book, a summary data loss events as well as the effective dates for state- of this consumer complaint database that contains based notification laws. We verified the laws’ effec- statistics about complaints, descriptions of complaint tive dates across at least two sources and combined categories, and sample complaints, as well as descrip- them with data loss event dates from the previously tions of Consumer Sentinel Network member orga- mentioned DataLossDB. Blue diamonds represent in- nizations and how much information each contributes dividual data loss events, and red squares represent the to the database.3 The total number of annual com- effective dates for different state-based data breach no- plaints has continually increased each year, more than tification laws. Gray vertical bars mark the times dur- doubling since 2002, suggesting that people might be ing which we conducted our surveys. Prior to the data more aware or concerned about their sensitive infor- breach notification laws, very few data breaches were mation as it pertains to identity theft and fraud. required by law to be publicly reported. It is plausible Reports of lost laptops or sensitive information that these new laws have led to the increase in publicly leaks in the press are becoming more frequent. Con- documented data breach incidents. sider the data loss events chronicled by the Privacy In addition to data breach laws, most states now Rights Clearinghouse’s A Chronology of Data Breaches have security freeze laws to protect consumers from 22 IEEE SECURITY & PRIVACY Internet Privacy identity theft. These laws allow consumers to put a tions.) We advertised the survey using a wide variety hold on their credit files to avoid anyone else from of mechanisms, including attaching fliers to bulletin being able to fraudulently open new accounts with boards around campus, posting announcements on stolen information. The first security freeze law went academic Web sites and professional/social network- into effect in California in 2003. Today, Washington, ing sites, and sending emails to our own personal and DC, and 47 states (excluding Alabama, Michigan, and family networks. Missouri) have followed suit. These laws vary from The 2008 survey resulted in a much larger sample state to state—for example, in Arkansas, Kansas, Mis- size, so we cannot compare two identical samples. sissippi, and South Dakota, the freeze applies only to However, the 2008 survey’s demographics are similar identity theft victims who file a police report, whereas to those of the 2002 survey—for example, most re- the other states allow any consumer to place a security spondents were male in both surveys, and the largest freeze on his or her own account anyway. In 2007, participant group was the 22-to-28 age group. Most the US credit bureaus began granting all consumers of the 2008 survey’s US respondents reported having the ability to set security freezes on their accounts; if a more than a college degree or some graduate school-