ABSTRACT
The growing availability of data and the emergence of business analytics ecosystems offer possibilities for companies developing innovative business models. However, the disruptive impact of these business models on society is not always judged favourably. This paper explores the growing tensions in the relationship between disruptive Big Data companies and society through the lens of legitimacy - a judgement about the fit and propriety of an entity, such as a company, to society. The study is based on four instrumental cases where Big Data organisations were faced with challenges to their legitimacy. The findings elaborate how digital transformations require companies to understand and manage how much to disrupt and how much to conform to social norms and values. Big Data businesses face a dynamic and paradoxical tension between the potential costs and benefits of their disruptive business models. The topic of legitimacy management is also addressed, drawing out implications for practice. Supplementary Information: The online version contains supplementary material available at 10.1007/s10796-021-10155-3.
ABSTRACT
BACKGROUND: The recent proliferation of self-tracking technologies has allowed individuals to generate significant quantities of data about their lifestyle. These data can be used to support health interventions and monitor outcomes. However, these data are often stored and processed by vendors who have commercial motivations, and thus, they may not be treated with the sensitivity with which other medical data are treated. As sensors and apps that enable self-tracking continue to become more sophisticated, the privacy implications become more severe in turn. However, methods for systematically identifying privacy issues in such apps are currently lacking. OBJECTIVE: The objective of our study was to understand how current mass-market apps perform with respect to privacy. We did this by introducing a set of heuristics for evaluating privacy characteristics of self-tracking services. METHODS: Using our heuristics, we conducted an analysis of 64 popular self-tracking services to determine the extent to which the services satisfy various dimensions of privacy. We then used descriptive statistics and statistical models to explore whether any particular categories of an app perform better than others in terms of privacy. RESULTS: We found that the majority of services examined failed to provide users with full access to their own data, did not acquire sufficient consent for the use of the data, or inadequately extended controls over disclosures to third parties. Furthermore, the type of app, in terms of the category of data collected, was not a useful predictor of its privacy. However, we found that apps that collected health-related data (eg, exercise and weight) performed worse for privacy than those designed for other types of self-tracking. CONCLUSIONS: Our study draws attention to the poor performance of current self-tracking technologies in terms of privacy, motivating the need for standards that can ensure that future self-tracking apps are stronger with respect to upholding users' privacy. Our heuristic evaluation method supports the retrospective evaluation of privacy in self-tracking apps and can be used as a prescriptive framework to achieve privacy-by-design in future apps.
