Business modelling for privacy investments Authors: Evert Jan de Jongste Ruud Brink PRIME Research a

1
Business modelling for privacy
investmentsAuthorsEvert Jan de JongsteRuud
BrinkPRIME Research assistants
2
Introduction

• PRIME Research assistant projects at the
  Rotterdam School of Management (RSM)
• Business model team
• Ruud Brink
• Evert Jan de Jongste
• PET evaluation team (workshop afternoon)
• Bert Meerman
• Frank Tewari

3
Business model team

• Research aim
• Provide decision support by setting up a business
  model for Privacy Enhancing Technology (PET)
  investments
• Research question
• Which business factors influence Privacy
  Enhancing Technology (PET) investments?
• How can those PET investment factors be
  quantified?

4
Privacy for business workshop

• Presentation aim
• Discuss research progress business model team
• Is PRIME a first mover in the field?
• Agenda
• 1. Introduction
• 2. Process
• 3. Content
• 4. Framework
• 5. Future research
• 6. Discussion and questions

5
2. Process

• What the business model team did
• Getting an overview of all the economics of
  privacy literature (200 studies)
• Investigation of the sources
• Distinguishing disciplines
• Extracting relevant factors
• Rank and categorize the factors

6
2. Process

• The different disciplines, e.g.
• Network economics
• Acting as a node in a network
• Switching cost
• Neoclassical economics
• The rationale human
• Profit optimalization
• Business research (e.g. Marketing)
• Customer Equity
• Brand, retention, perception

7
3. Content

• Research methods
• 3.1. Empirical studies (Customer) surveys
• 3.2. Meta analysis (desk research)
• 3.3. Logic (economic modeling/ reasoning)

8
3. Content literature review

• 3.1 Empirical studies
• Huberman (xxxx) n127
• Conducted second-price auction to identify
  monetary value for private information
• Highlight contextual nature (demographics,
  gender) of people determine how privacy is
  perceived (also supported by Dommeyer (2003))
• Jamal (2002)
• Chellappa (2002)

9
3. Content literature review

• 3.2 Desk research studies
• Odlyzko (2003)
• Need for customer information to enable
• Higher profitability p/customer (Price
  discrimination)
• Higher customer retention (Staten, 2001)
• Miyoshi, Ho (2002)
• Survey Privacy and American business 62 hires
  privacy specialists (e.g. Privacy officer are
  paid over USD 100.000)
• Hahn (2001)
• Estimation of costs of various aspects of privacy
  legislation compliance system for websites (IS
  development costs)
• Estimation USD 190.000 (Expert survey n17)

10
3. Content literature review

• 3.3 Logic (economic modeling/ reasoning)
• Gellman (2002)
• Hirschleifer (2004)
• Cate et al (XXXX)
• lack of benefits of informationsharing
• Acquisity et al, at least 2004
• Network theory

11
3. Content - conclusion

• The Articles pointed out several factors in
  relation to privacy. Though, there are some
  problems with that factors
• The reality is that not much in the way of
  quantification exists.(Hahn, 2001)
• There are hardy no factors that directly
  influence the privacy investment(Gellman, 2002)
• Factors are only relevant in their own context.
  Removing underlying assumptions make the factors
  useless
• Factors are interrelated
• Factors are not unique for Privacy

12
4. Process - The Baseline

• setting the baseline is necessary to derive
  relevant variables
• startingpoint can be
• the changing law
• changes in the market what does the competitor?
• Technological development
• Our data input
• The Airline Sector
• Specific investments in PETs

13
5. Framework

• External dimension
• Operational risk envelope Arthur Andersen (Davies
  et al, 1998 Doulas et al., 1998)
• Driving factor categorization
• Political (e.g. Tax and regulation)
• Legal (compliance)
• Physical and crime (non compliance)
• Information Technology
• Market
• Credit and settlement

14
5. Framework

• Internal dimension
• Privacy risk assessment (Miyoshi, 2002) and
  Privacy Impact Assessment (Stewart, xxxx)
• Develop a framework to assess a companies
  privacy risk
• Personnel, privacy policy related, training,
  monitoring, audit, PET (Privacy Enhancing
  Technology), regulatory fines, lawsuits, stock
  price decline, reputation damage
• Risk assessment framework (Hoffman, 1998)
• Operational risk measurement process
• Internal factor categorization People, process,
  technology
• Probability (P)
• Severity (S)

15
5. Framework

• Output
• Inv. Decision
• Resource all.

• Input/ baseline
• Sector
• PET inv.

P-gt profit
Identifying and evaluating privacy risks
S-gt Very high very low
Based on Hoffman, 1998
16
5. Framework?

• Why that complexity?
• a lot of variables therefore the need to
  categorize them
• Because of the measurability the indicators have
  to be somewhere in the business
• the literature factors are indicators for the
  categories

17
6. Further research

• Business model -gt case
• The output
• Make a description of the relevant variables
• Designing a spreadsheet model

18
6. Further research

• Research tasks
• Conceptualisation of factors
• Operationalisation of factors
• Measurement of factors
• Business modeling

19
Conclusion

• Business modeling for privacy investments is
  pioneer work
• A lot of questions,
• A lot of trade-offs but
• No old research to lean on
• The next business modeling team opportunity
• Gathering empirical data (starting at Airline
  cases) to found the business model (THEORIC
  RELEVANCE) and support the decision process of
  managers selecting PETs (PRACTICAL RELEVANCE)
• We are driven by theory and practice.

20

• Discussion
• and
• questions