A Theory of Multilevel Information Privacy Management for the Digital Era

In the digital era, it is increasingly important to understand how privacy decisions are made because information is frequently perceived as a commodity that is mismanaged. The preponderance of privacy literature focuses on individual-level information privacy concern and personal self-disclosure decisions. We propose that a more versatile multilevel description is required to enable exploration of complex privacy decisions that involve co-owned (i.e., group) information in increasingly sophisticated digital environments. We define the concepts of group and individual information privacy, “we-privacy” and “I-privacy” respectively, as the ability of an individual or group to construct, regulate, and apply the rules for managing their information and interaction with others. We develop the theory of multilevel information privacy (TMIP), which uses the theory of communication privacy management and the developmental theory of privacy as foundations for a social rule-based (i.e., normative) process of making privacy decisions that evolve over time with experience. The TMIP contributes to the privacy literature by drawing from prominent social psychology theories of group behavior (i.e., social identity and self-categorization theories) to explain how privacy decisions can be made by individuals or groups (i.e., social units) or social units acting as members of a particular group. We contend that technology complicates the privacy decision-making process by adding unique environmental characteristics that can influence the social identity assumed for a particular privacy decision, the estimation of the cost-benefit components of the privacy calculus, and the application and evolution of the norms that define the rules for information and interaction management. We discuss the implications of the TMIP for information systems research and provide a research agenda.