90
lobbying often aims at shaping rules for privacy in the best interest of the
organization, some organizations may try to shape the rules in a way that
favors society’s needs for privacy. The inclusion of the philanthropic
dimension is important, as organizations taking privacy actions beyond
their corporate obligations have been found to experience less privacy incidents (Accenture and Ponemon 2015). It therefore seems reasonable to
suggest that the philanthropic privacy dimension may help identify privacy
behaviors that could help strengthen privacy protection effectiveness.
Although privacy behaviors ‘beyond that which is required by law’ may
demonstrate the differentiating behaviors of justice that this chapter is
keen to explore, it is important to highlight that this concept of ‘beyond
that which is required by law’ differs from one jurisdiction to another. For
instance, the GDPR mandates that organizations provide transparency,
choice, purpose and notice to the data subject. Many other jurisdictions,
particular large sectors of the US, do not mandate the provision of these
privacy behaviors through regulation but through industry self-regulation
and discretionary codes such as FIPPs. Thus, choice for example, would
be considered a legal requirement within GDPR, and in certain US contexts an ethical requirement. This is an important consideration for any
future application of our framework, as an evaluation of the local privacy
landscape for a given organization would first be required, in order to
determine their legal minimums.
5.4.1 Framework Dimensions
Greenaway et al. (2015), combine control and justice theory to form a
privacy orientation which they call Company Information Privacy
Orientation (CIPO). Their research forms the starting point for the construction of the privacy orientation framework we develop in this chapter.
Greenaway et al. (2015) suggest that an organization’s privacy orientation
is founded on three dimensions namely: information management (i.e.
how an organization uses information for profit), legal and ethical dimensions. These three dimensions are underpinned by several theoretical components: stakeholder theory, stockholder theory, social contract theory,
information processing theory and cognitive categorization theory
(Greenaway et al. 2015). Through triangulation of their three CIPO
dimensions with the four pillars of CSR from Carroll’s (1979) CSR pyramid of responsibilities (economic, legal, ethical, and philanthropic), we
extend the CIPO framework with the addition of the philanthropic
V. LYONS
lobbying often aims at shaping rules for privacy in the best interest of the
organization, some organizations may try to shape the rules in a way that
favors society’s needs for privacy. The inclusion of the philanthropic
dimension is important, as organizations taking privacy actions beyond
their corporate obligations have been found to experience less privacy incidents (Accenture and Ponemon 2015). It therefore seems reasonable to
suggest that the philanthropic privacy dimension may help identify privacy
behaviors that could help strengthen privacy protection effectiveness.
Although privacy behaviors ‘beyond that which is required by law’ may
demonstrate the differentiating behaviors of justice that this chapter is
keen to explore, it is important to highlight that this concept of ‘beyond
that which is required by law’ differs from one jurisdiction to another. For
instance, the GDPR mandates that organizations provide transparency,
choice, purpose and notice to the data subject. Many other jurisdictions,
particular large sectors of the US, do not mandate the provision of these
privacy behaviors through regulation but through industry self-regulation
and discretionary codes such as FIPPs. Thus, choice for example, would
be considered a legal requirement within GDPR, and in certain US contexts an ethical requirement. This is an important consideration for any
future application of our framework, as an evaluation of the local privacy
landscape for a given organization would first be required, in order to
determine their legal minimums.
5.4.1 Framework Dimensions
Greenaway et al. (2015), combine control and justice theory to form a
privacy orientation which they call Company Information Privacy
Orientation (CIPO). Their research forms the starting point for the construction of the privacy orientation framework we develop in this chapter.
Greenaway et al. (2015) suggest that an organization’s privacy orientation
is founded on three dimensions namely: information management (i.e.
how an organization uses information for profit), legal and ethical dimensions. These three dimensions are underpinned by several theoretical components: stakeholder theory, stockholder theory, social contract theory,
information processing theory and cognitive categorization theory
(Greenaway et al. 2015). Through triangulation of their three CIPO
dimensions with the four pillars of CSR from Carroll’s (1979) CSR pyramid of responsibilities (economic, legal, ethical, and philanthropic), we
extend the CIPO framework with the addition of the philanthropic
V. LYONS