Organisational Privacy Culture and Climate: A Scoping Review

Abstract

New regulations worldwide are increasingly pressing organisations to review how they collect and process personal data to ensure the protection of individual privacy rights. This organisational transformation involves implementing several privacy practices (e.g., privacy policies, governance frameworks, and privacy-by-design methods) across multiple departments. The literature points to a strong influence of the organisations' culture and climate in implementing such privacy practices, depending on how leaders and employees perceive and address privacy concerns. However, this new hybrid topic referred to as Organisational Privacy Culture and Climate (OPCC), remains poorly demarcated and weakly defined. In this paper, we report a Scoping Review (ScR) on the topic of OPCC to systematically identify and map studies, contributing with a synthesis of the existing work, distinguishing core and adjacent publications, research gaps, and pathways of future research. This ScR includes 36 studies categorised according to their demographics, research types, contribution types, research designs, proposed definitions, and conceptualisations. Also, 18 studies categorised as primary research were critically appraised, assessing the studies' methodological quality and credibility of the evidence. Although published research has significantly advanced the topic of OPCC, more research is still needed. Our findings show that the topic is still in its embryonic stage. The theory behind OPCC has not yet been fully articulated, even though some definitions have been independently proposed. Only one measuring instrument for privacy culture was identified, but it needs to be further developed in terms of identifying and analysing its factors, and evaluating its validity and reliability. Initiatives of future research in OPCC will require interdisciplinary research efforts and close cooperation with industry to further propose and rigorously evaluate instruments. Only then OPCC would be considered an evidence-based research topic that can be reliably used to evaluate, measure, and embed privacy in organisations.

Privacy Engineering in the Wild: Understanding the Practitioners' Mindset, Organisational Culture, and Current Practices

“…It is also worth mentioning that six out of the ten studies in the related work (see Table 1) are country-specific, i.e., in which all the interviewed participants live in the same country. The importance of including more diverse populations and independently replicating prominent studies has already been stressed in the literature, such as the scoping review on OPCC [43]. For such reasons, our research contributes to the existing body of evidence, corroborating and introducing new findings.…”

“…Scholars have also turned to large software repositories (e.g., GitHub and Stack Overflow), mining posts and question-and-answer websites to interpret how developers talk about privacy [40], [41]. Lastly, secondary research, in the forms of systematic reviews, has also been able to synthesise this growing body of evidence on factors affecting the implementation of privacy and security practices [42] and the conceptualisation of emerging topics such as Organisational Privacy Culture and Climate (OPCC) [43].…”

“…Currently, the field of Organisational Privacy Culture and Climate (OPCC) remains largely unexplored from information systems and software engineering perspectives. A scoping review on the topic has shown that the area is still emerging and that there needs to be more primary research to substantiate its theory, constructs, and practical instruments [43]. Studies such as [68], [6], and [8] are some examples of quantitative and qualitative research.…”

On the Evaluation of Privacy Impact Assessment and Privacy Risk Assessment Methodologies: A Systematic Literature Review

“…Case studies are shown to be one of the most common methodologies for evaluation; nonetheless, other methodologies could be considered, such as using grounded theory in the context of socio-technical systems [96]. This need for further evaluation research has also been discussed in the broader area of privacy engineering [14], [97].…”

Privacy Engineering in the Wild: Understanding the Practitioners’ Mindset, Organizational Aspects, and Current Practices

“…Scholars have also turned to large software repositories (e.g., GitHub and Stack Overflow), mining posts and question-and-answer websites to interpret how developers talk about privacy [57], [58]. Lastly, secondary research, in the forms of systematic reviews, has also been able to synthesise this growing body of evidence on factors affecting the implementation of privacy and security practices [59] and the conceptualisation of emerging topics such as Organisational Privacy Culture and Climate (OPCC) [60].…”