Designing A Cloud Privacy Audit Framework

• In Event: Modeling and Design Science

Abstract

This research is about understanding the relationship between individual values and their privacy objectives. There is a lack of clarity in organizations as to what individuals consider privacy to be. Therefore, it is important to understand individual’s privacy values. This study is concerned with understanding individual privacy in emerging cloud environments. We argue that privacy in emerging environments is an elusive concept due to the evolving relationship between technology and privacy. The motivation for this research stems from a concern that the notion of privacy is disappearing as technology becomes more pervasive. Understanding and identifying individuals’ privacy values with respect to personal information privacy is important for the development of privacy objectives for cloud computing.
The aim of this study is to develop an understanding of the linkages between individual privacy values and personal privacy objectives and understand how to ensure strategic alignment of an organizations privacy practices to their customers’ value system. This study uses multiple research methods, Value focus thinking and design science research methodology, to develop a cloud privacy audit framework.
We utilized a value focused thinking approach to identify individual privacy values with respect to emerging cloud technologies and to develop an understanding of how cloud privacy objectives are shaped by individual’s privacy values. We interview 90 individuals to elicit individual privacy values in the context of cloud technologies. Then we followed the Keeney’s approach to convert individual privacy values into groups of objectives, which resulted in 23 privacy objectives. We then used these objectives as a foundation to design a cloud privacy audit framework following the design science research methodology framework developed by Peffers et al. (2008). Our resulting framework was then evaluated and assessed based by a confirmatory group of information system auditors. The contribution of this paper is to both individuals in academia through an innovative combination of value focus thinking and design science research methodologies, and those in practice through the creation of an effective privacy audit planning tool.

Authors

• David Lewis Coss, College of Charleston

• Gurpreet Dhillon, Virginia Commonwealth University