1. EFRIM BORITZ WON GYUN NO R. P. SUNDARRAJ The Effect of Involvement and Privacy Policy Disclosure on Individuals’ Privacy Behaviour DISCUSSANT COMMENTS James E. Hunton, Bentley

2. Purpose The purpose of this paper is to examine the extent to which an internet vendor’s privacy policy disclosures can affect an individual’s propensity to provide personal information over the internet, depending on the perceived sensitivity of such information.

3. Motivation The general issue of information privacy is certainly relevant given the increasingly digitized world in which we live. The misuse of such information, as with identify theft, can harm affected individuals in myriad ways.

4. Overall Observation The paper is very confusing to read—often jumping back and forth in a way that makes it very difficult to understand. One of the first points of confusion was the authors’ meaning of the term ‘level of involvement with privacy’.

5. Overall Observation The authors (finally) defined ‘involvement’ as “…an unobservable state of motivation, arousal or interest” (Rothschild 1984). They then use the Elaboration Likelihood Model (Petty and Cacioppo 1986) as the primary theory

6. Elaboration Likelihood Model Central Cues --Diagnostic-- Merits of persuasive arguments Peripheral Cues --Non-Diagnostic-- HeuristicsBiases According to Petty et al. (1987) the term elaboration refers to an individual’s motivation to exert considerable cognitive effort toward evaluating issue- relevant information

7. Current Construct Map Motivation to exert effortLeads To to exert effort Privacy Involvement Privacy Disclosure Elaboration +

8. Risk and Trust Rather than ELM, combine two theories:  Multidimensional Development Theory of Privacy  Theory of Planned Behavior Perceived Information Risk Trust in Information Use and Security Search for Risk-Reducing Information Provision of Sensitive Personal Information +++ BeliefBehaviorAttitudeBehavior

9. Internal Validity The research method was rather complex and confusing. First, participants were randomly assigned to one of the six experimental treatments. Then, participants completed a web-based survey. Based on their answers to certain questions, subsequent survey items were altered. Specific privacy information to be used in the high and low privacy involvement (information risk) treatments was established.

10. Internal Validity For example, if a participant was randomized into the high information risk treatment, and identified SIN and SID as the two most sensitive pieces of private information, these two pieces appeared in subsequent survey questions and were used to operationalize the high risk treatment in the post- survey experiment

11. Demand Effects Consider a participant who just said that SIN and SID were the two most sensitive pieces of personal information, and then were presented with a ‘mock’ website (see Figure 3a):  How likely would you be to complete this form when SIN and SID are requested?  If the web site had a privacy policy statement, how likely would you be to complete this form when SIN and SID are requested?  If the web site had a privacy policy statement and a privacy seal {e.g., TRUSTe} how likely would you be to complete this form when SIN and SID are requested?

12. Demand Effects The cat is out of the bag; meaning, the participants likely know that the experimenter wants to study which can affect how they will respond when asked for, what they deem to be, sensitive personal information. Further, the participants are now primed about the upcoming privacy disclosure treatment used in the experiment, as they are asked on the same form (Figure 3a) to identify the two most and least important privacy practices.

13. Suggestions for Improvement The construct of ‘Trust’ was not explicitly measured, so the researchers would have to reason that increased trust is implied by the willingness to provide sensitive personal information. Perceived Information Risk Provision of Sensitive Personal Information Search for Risk-Reducing Information Link 1 Link 2

14. Suggestions for Improvement Collapse the experimental design. Perceived Information Risk LowHigh PrivacyNo Policy Disclosure Yes

15. Suggestions for Improvement H1:Individuals who perceive relatively high private information risk will be more motivated to read a company’s privacy policy disclosure than individuals who perceive relatively low private information risk. Perceived Information Risk Provision of Sensitive Personal Information Search for Risk-Reducing Information Link 1 Link 2

16. Suggestions for Improvement H2:When individuals perceive relatively high private information risk, they will be more likely to provide sensitive information to a web-based company that discloses its privacy policy, as compared to a company that does not disclose its privacy policy. Perceived Information Risk Provision of Sensitive Personal Information Search for Risk-Reducing Information Link 1 Link 2

17. Suggestions for Improvement H3:When individuals perceive relatively high private information risk and read the web-based company’s privacy policy, there will be a positive relationship between the time they spend reading the policy and the provision of sensitive information. Perceived Information Risk Provision of Sensitive Personal Information Search for Risk-Reducing Information Link 1 Link 2

18. Suggestions for Improvement If a person spends more time reading the disclosures, one could reason that he/she is more likely to notice the omission of the two most important privacy practices; therefore, he/she will be less likely to provide the personal information than one who spent less time reading the disclosure Perceived Information Risk Provision of Sensitive Personal Information Search for Risk-Reducing Information Link 1 Link 2 H3

19. Suggestions for Improvement The experiment is interesting because it tracks actual behaviour, but it is threatened by potential demand effects; thus readers should be cautious in drawing inferences from the experimental findings. The ‘take away’ from this study is that before individuals provide, what they deem to be, sensitive personal information over the internet, they need to trust that the organization will properly use and secure the information. This ‘need for trust’ suggests that companies should be transparent about their privacy policy practices, thereby providing customers with sufficient and necessary information to make an informed decision.