An online world exists in which businesses have become burdened with managerial and legal duties regarding the seeking of informed consent and the protection of privacy and personal data, while growing public cynicism regarding personal data collection threatens the healthy development of marketing and e-commerce. This research seeks to address such cynicism by assisting organisations to devise ethical consent management processes that consider an individual’s attitudes, their subjective norms and their perceived sense of control during the elicitation of consent. It (...) does so by developing an original conceptual model for online informed consent, argued through logical reasoning, and supported by an illustrative example, which brings together the autonomous authorisation (AA) model of informed consent and the theory of planned behaviour (TPB). Accordingly, it constructs a model for online informed consent, rooted in the ethic of autonomy, which employs behavioural theory to facilitate a mode of consent elicitation that prioritises users’ interests and supports ethical information management and marketing practices. The model also introduces a novel concept, the informed attitude, which must be present for informed consent to be valid. It also reveals that, under certain tolerated conditions, it is possible for informed consent to be provided unwillingly and to remain valid: this has significant ethical, information management and marketing implications. (shrink)

Recent scholarship in business ethics has revealed the importance of privacy expectations as they relate to implicit privacy norms and the business practices that may violate these expectations. Yet, it is unclear how and when businesses may violate these expectations, factors that form or influence privacy expectations, or whether or not expectations have in fact been violated by company actions. This article reports the findings of three studies exploring how and when the corporate dissemination of consumer data violates privacy expectations. (...) The results indicate that consumer sentiment is more negative following intentional releases of sensitive consumer data, but the effect of data dissemination is more complex than that of company intentionality and data sensitivity alone. Companies can effectively set, and re-affirm, privacy expectations via consent procedures preceding and succeeding data dissemination notifications. Although implied consent has become more widely used in practice, we show how explicit consent outperforms implied consent in these regards. Importantly, this research provides process evidence that identifies perceived violation of privacy expectations as the underlying mechanism to explain the deleterious effects, on consumer sentiment, when company actions are misaligned with consumers’ privacy expectations. Ethical implications for companies collecting and disseminating consumer information are offered. (shrink)

A growing body of theory has focused on privacy as being contextually defined, where individuals have highly particularized judgments about the appropriateness of what, why, how, and to whom information flows within a specific context. Such a social contract understanding of privacy could produce more practical guidance for organizations and managers who have employees, users, and future customers all with possibly different conceptions of privacy across contexts. However, this theoretical suggestion, while intuitively appealing, has not been empirically examined. This study (...) validates a social contract approach to privacy by examining whether and how privacy norms vary across communities and contractors. The findings from this theoretical examination support the use of contractual business ethics to understand privacy in research and in practice. As predicted, insiders to a community had significantly different understandings of privacy norms as compared to outsiders. In addition, all respondents held different privacy norms across hypothetical contexts, thereby suggesting privacy norms are contextually understood within a particular community of individuals. The findings support two conclusions. First, individuals hold different privacy norms without necessarily having diminished expectations of privacy. Individuals differed on the factors they considered important in calculating privacy expectations, yet all groups had robust privacy expectations across contexts. Second, outsiders have difficulty in understanding the privacy norms of a particular community. For managers and scholars, this renders privacy expectations more difficult to identify at a distance or in deductive research. The findings speak directly to the needs of organizations to manage a diverse set of privacy issues across stakeholder groups. (shrink)

This paper presents an ethical framework designed to support the development of critical data literacy for research methods courses and data training programmes in higher education. The framework we present draws upon our reviews of literature, course syllabi and existing frameworks on data ethics. For this research we reviewed 250 research methods syllabi from across the disciplines, as well as 80 syllabi from data science programmes to understand how or if data ethics was taught. We also reviewed 12 data ethics (...) frameworks drawn from different sectors. Finally, we reviewed an extensive and diverse body of literature about data practices, research ethics, data ethics and critical data literacy, in order to develop a transversal model that can be adopted across higher education. To promote and support ethical approaches to the collection and use of data, ethics training must go beyond securing informed consent to enable a critical understanding of the techno-centric environment and the intersecting hierarchies of power embedded in technology and data. By fostering ethics as a method, educators can enable research that protects vulnerable groups and empower communities. (shrink)

This paper investigates the drivers and inhibitors of Internet privacy concern. Applying the Multidimensional Development Theory to the online environment, we identify the important factors under four dimensions—i.e., environmental, individual, information management, and interaction management. We tested our model using data from an online survey of 2417 individuals in Hong Kong. The results show that the factors under all four dimensions are significant in the formation of Internet privacy concern. Specifically, familiarity with government legislation, Internet knowledge, benefit of information disclosure, (...) privacy protection, and social presence reduce Internet privacy concern, while individuals’ previous privacy invasion experience, risk avoidance personality, and sensitivity of information requested by websites increase Internet privacy concern. We conducted an analysis of unobserved heterogeneity to confirm the significance of these factors. A follow-up moderation analysis shows that the individual factors moderate the effects of the information management factor and the interaction management factors. The findings provide an integrated understanding of the formation of Internet privacy concern. (shrink)

Ethical concerns of Internet users continue to rise. Accordingly, several scholars have called for systematic empirical research to address these issues. This study examines the conceptualization and measurement of consumers' perceptions regarding the ethics of online retailers (CPEOR). Also, this research represents a first step into the analysis of the relationship between CPEOR, consumers' general Internet expertise and reported positive word of mouth (WOM). Results, from a convenience sample of 357 online shoppers, suggest that CPEOR can be operationalized as a (...) second-order construct composed of four dimensions: security, privacy, fulfillment, and non-deception. Our findings also indicate that consumers' general Internet expertise significantly improves CPEOR and CPEOR are strongly predictive of consumers' WOM. Managerial and research implications are offered. (shrink)

Revelations of personal matters often have negative consequences for social-media users. These consequences trigger frequent warnings, practical rather than moral in nature, that social-media users should consider carefully what they reveal about themselves since their revelations might cause them various difficulties in the future. I set aside such practical considerations and argue that social-media users have a moral obligation to maintain their own privacy that is rooted in the duty to self-censor. Although Anita L. Allen provides a paternalist justification of (...) the duty that supports my position that social-media users are obligated to self-censor what they reveal about themselves, I justify the obligation through considerations that are more palatable to liberals than is paternalism. I accomplish this by arguing that the failure to self-censor often creates for others undue burdens that individuals are obligated morally not to create. In particular, social-media revelations often create undue burdens for those, such as employers and university personnel, who are obligated morally to respect individuals’ privacy in their decision-making processes. I also demonstrate that this argument is not for a broad duty to self-censor, but, rather, for a narrow duty that applies to particular circumstances such as certain uses of social media. (shrink)

Recent scholarship in philosophy, law, and information systems suggests that respecting privacy entails understanding the implicit privacy norms about what, why, and to whom information is shared within specific relationships. These social contracts are important to understand if firms are to adequately manage the privacy expectations of stakeholders. This paper explores a social contract approach to developing, acknowledging, and protecting privacy norms within specific contexts. While privacy as a social contract—a mutually beneficial agreement within a community about sharing and using (...) information—has been introduced theoretically and empirically, the full impact on firms of an alternative framework to respecting the privacy expectations of stakeholders has not been examined. The goal of this paper is to examine how privacy norms develop through social contract’s narrative, to redescribe privacy violations given the social contract approach, and to critically examine the role of business as a contractor in developing privacy norms. A social contract narrative dealing specifically with issues of privacy is an important next step in exploring a social contract approach to privacy. Here, the narrative is used to explain to analyze the dynamic process of privacy norm generation within particular communities. Based on this narrative, individuals within a given community discriminately share information with a particular set of obligations in mind as to who has access to the information and how it will be used. Rather than giving away privacy, individuals discriminately share information within a particular community and with norms governing the use of their information. Similar to contractual business ethics’ impact on global commerce in explaining how and why norms vary across global contexts, the social contract approach to privacy explains how and why norms vary across communities of actors. Focusing on agreements around privacy expectations shifts the responsibility of firms from adequate notification to the responsibility of firms as contractors to maintain a mutually beneficial and sustainable solution. (shrink)

Information technology and the Internet have added a new stakeholder concern to the corporate social responsibility (CSR) agenda: online privacy. While theory suggests that online privacy is a CSR, only very few studies in the business ethics literature have connected these two. Based on a study of CSR disclosures, this article contributes to the existing literature by exploring whether and how the largest IT companies embrace online privacy as a CSR. The findings indicate that only a small proportion of the (...) companies have comprehensive privacy programs, although more than half of them voice moral or relational motives for addressing online privacy. The privacy measures they have taken are primarily compliance measures, while measures that stimulate a stakeholder dialogue are rare. Overall, a wide variety of approaches to addressing privacy was found, which suggests that no institutionalization of privacy practices has taken place as yet. The study therefore indicates that online privacy is rather new on the CSR agenda, currently playing only a minor role. (shrink)

Ethical concerns of Internet users continue to rise. Accordingly, several scholars have called for systematic empirical research to address these issues. This study examines the conceptualization and measurement of consumers' perceptions regarding the ethics of online retailers. Also, this research represents a first step into the analysis of the relationship between CPEOR, consumers' general Internet expertise and reported positive word of mouth. Results, from a convenience sample of 357 online shoppers, suggest that CPEOR can be operationalized as a second-order construct (...) composed of four dimensions: security, privacy, fulfillment, and non-deception. Our findings also indicate that consumers' general Internet expertise significantly improves CPEOR and CPEOR are strongly predictive of consumers' WOM. Managerial and research implications are offered. (shrink)

Information technology and the Internet have added a new stakeholder concern to the corporate social responsibility (CSR) agenda: online privacy. While theory suggests that online privacy is a CSR, only very few studies in the business ethics literature have connected these two. Based on a study of CSR disclosures, this article contributes to the existing literature by exploring whether and how the largest IT companies embrace online privacy as a CSR. The findings indicate that only a small proportion of the (...) companies have comprehensive privacy programs, although more than half of them voice moral or relational motives for addressing online privacy. The privacy measures they have taken are primarily compliance measures, while measures that stimulate a stakeholder dialogue are rare. Overall, a wide variety of approaches to addressing privacy was found, which suggests that no institutionalization of privacy practices has taken place as yet. The study therefore indicates that online privacy is rather new on the CSR agenda, currently playing only a minor role. (shrink)

While e-commerce has witnessed extensive growth in recent years, so has consumers’ concerns regarding ethical issues surrounding online shopping. The vast majority of earlier research on this area is conceptual in nature, and limited in scope by focusing on consumers’ privacy issues. This study develops a reliable and valid scale to measure consumers’ perceptions regarding the ethics of online retailers. Findings indicate that the four factors of the scale – security, privacy, non-deception and fulfillment/reliability – are strongly predictive of online (...) consumers’ satisfaction and trust. The results offer important implications for e-retailers and are likely to stimulate further research in the area of e-ethics from the consumers’ perspective. (shrink)

The General Data Protection Regulation (GDPR) of the EU confirms the protection of personal data as a fundamental human right and affords data subjects more control over the way their personal information is processed, shared, and analyzed. However, where data are processed by artificial intelligence (AI) algorithms, asserting control and providing adequate explanations is a challenge. Due to massive increases in computing power and big data processing, modern AI algorithms are too complex and opaque to be understood by most data (...) subjects. Articles 15 and 22 of the GDPR provide a modest regulatory framework for automated data processing by, among other things, mandating that data controllers inform data subjects about when it is being used, and its logic and ramifications. Nevertheless, due to the phrasing of the articles and the numerous exceptions they allow, doubts have arisen about their effectiveness. In this paper, we empirically evaluate the quality and effectiveness of AI disclosures as mandated by the GDPR. By means of an online survey (N = 835), we investigated how data subjects expect to be informed about the automated processing of their data. We then conducted a content analysis of the AI disclosures of N = 100 companies and organizations. The combined findings reveal that current GDPR-mandated disclosures do not meet the expectations and needs of data subjects. Explanations drawn up following the guidelines of the generic formulations of the GDPR differ widely and are often vague, incomplete and lack transparency. In our conclusions we identify a path towards standardizing and optimizing AI information notices. (shrink)

While e-commerce has witnessed extensive growth in recent years, so has consumers' concerns regarding ethical issues surrounding online shopping. The vast majority of earlier research on this area is conceptual in nature, and limited in scope by focusing on consumers' privacy issues. This study develops a reliable and valid scale to measure consumers' perceptions regarding the ethics of online retailers. Findings indicate that the four factors of the scale - security, privacy, non-deception and fulfillment/reliability - are strongly predictive of online (...) consumers' satisfaction and trust. The results offer important implications for e-retailers and are likely to stimulate further research in the area of e-ethics from the consumers' perspective. (shrink)