Online privacy and culture: evidence from Japan By Yohko Orito, Kiyoshi Murata, Yasunori Fukuta, Steve McRobb and Andrew A. Adams Abstract Almost every shopping website now posts its privacy policy online. Although the recognition of the right to privacy is inevitably affected by socio-cultural circumstances, there has been very little examination of the recognition of online privacy policies from a cross-cultural perspective. We analysed the results of a survey that investigated young Japanese people’s awareness of online privacy policies as the first step in considering socio-cultural factors in this area. Through the analysis and discussions of the survey results, we considered the implications for Japanese society and businesses committed to the protection of online privacy. 1 Introduction There is an online privacy policy posted on almost every commercial and government website in today’s Internet society. There have been numerous studies of online privacy policies, some of which have pointed out interesting contradictions concerning the effectiveness of these policies. For instance, Pollach [2007] suggests that online privacy policies have been drafted with the threat of privacy litigation in mind, rather than as a commitment to the appropriate handling of data. This is not surprising from the viewpoint of the Japanese socio-cultural circumstances surrounding information privacy. However, because information and communication technology is global in nature, specific aspects may need to be examined from a local perspective. Very few studies have attempted to analyse the effectiveness of online privacy policies while taking into account local socio-cultural factors. Faced with this lack of research, we decided to launch a cross-cultural comparative research project on online privacy in Japan and the UK [McRobb et al., 2007]. This aims to examine whether and how privacy policies are perceived differently in Japanese and British cultures, which have different concepts of privacy and social values. We think that it will be helpful to identify how information privacy is recognised and what the attitudes are towards it in two very different cultures. This may assist organisations in becoming more culturally sensitive in their statements and practice concerning information privacy. This part of the research project focuses on Japan. We analysed the results of a survey that provided material for a preliminary study of the awareness about online privacy of young Japanese people as customers of online shopping sites or business to commerce (B to C) e-commerce sites. The survey participants were thirdand fourth-year students at Japanese universities. In general, they have more experience with online shopping than their parents’ generation and tend to be less hesitant to access online shopping sites and to use credit cards online. The survey included questions to check respondents’ individual attributes; their experience with Internet access and online shopping; their knowledge of factors associated with online shopping such as cookies, secure site seals or privacy seals, and phishing; and their understanding of and attitude towards online privacy policies. The remainder of this paper is structured as follows. In the next section, we explain the survey purpose and method. In section 3, the results of the main survey and additional interview questions are described and examined from the viewpoints of online privacy policies and online business. Based on the results and discussion, we describe the implications for Japanese society and online business in the final section. 2 Overview of the survey A survey was conducted in April 2008 to investigate the behaviour of young Japanese people with respect to online privacy. Respondents to the survey were third- and fourth-year students at the School of Commerce of Meiji University in Tokyo, the capital city of Japan, and at the Faculty of Law and Letters of Ehime University in the traditional local city of Matsuyama. Of the 431 survey responses (235 at Meiji University and 196 at Ehime University), 416 were valid (234 and 182 respectively). There are several reasons why university students were selected as respondents to this survey. One of the most important reasons was their technological background. In Japan, 1995 was called the “First Year of the Internet,” when personal computers with Microsoft Windows 95 and Internet Explorer were first marketed in the country and concentrated development of the broadband network began. Since that time, the use of computers has increased, and regular Internet connectivity at a fixed low access fee has become common. It was expected that third- and fourth-year university students aged 19–24 years would have a level of Internet experience much greater than that of their parents’ generation. Another reason is that young Japanese people are reputed to be more sensitive to privacy issues than older people. In addition, the two universities from which the survey respondents were chosen have maintained above-normal levels of research and education compared to other Japanese universities, and it was expected that the respondents would be better able to understand the survey contents. Moreover, because this survey was used as part of the coursework at each university, the students could be expected to take it seriously, and the response validity would be better than a Web-based questionnaire. The valid response rate of 96.5% was very high. The survey questionnaire, which was the very first survey for our study of online privacy and culture, was developed carefully to examine the recognition and knowledge of online privacy. The title of the questionnaire was “Online Shopping Survey,” and there was an explicit statement at the start of the questionnaire that “the aim of this survey is to analyse the relationship between online shopping behaviour and local culture.” The complete questionnaire is provided in Appendix 1. The personal attributes of the survey respondents are shown in Table 1. The independence of the questionnaire results was checked using Pearson's chi-square test and Fisher's exact test; these gave results that seemed irrational or counterintuitive. Hence, two additional interview surveys were conducted with 16 students the first time and 15 students the second time. Table 1. Respondents’ attributes Age (Number of respondents, %) Gender (%) Q1. Have you ever accessed the Internet? (%) Q4. Have you ever purchased anything from online shopping sites? (%) 19 86 (20.7) 20 197 (47.4) 21 104 (25.0) Male 249 (59.9) Yes 410 (98.6) 22 21 (5.0) 23 7 (1.7) 24 1 (0.7) Female 167 (40.1) No 6 (1.4) Yes No 292 (71.7) 115 (28.3) 3 Results and Discussion 3.1 Effectiveness of online privacy policies The results of the survey provided some interesting findings. First, respondents who accepted the importance of online privacy policies for their online shopping tended to read the policies more than the respondents who do not (**p < .01). However, more than half of the respondents who acknowledged the importance of the policies did not actually read them very frequently (Table 2) and were not sure if online shopping companies complied with own their online privacy policies (Table 3). Moreover, the majority of respondents found that online privacy policies were not easy to understand (Table 4). Some respondents said during interviews that almost no online privacy policies were designed to facilitate consumers’ understanding of them and that many policies were similar. Therefore, the students were not particularly motivated to read and/or understand the policies. One of the respondents answered that while privacy policies posted online were better than none at all, he gave more weight to the overall reputation and/or name of the company when purchasing online. Another student stated that it was the presence, rather than the content, of the online privacy policies that was important because any policy would provide him with an opportunity for legal action if some misuse of personal information occurred. These results and answers may imply that an online privacy policy is just a hygiene factor from the respondents’ point of view. In other words, posting online privacy policies may not serve as an active motivator for promoting online shopping. On the other hand, it seems plausible that online privacy policies are recognised as Tatemae, what is described as “for the sake of courteousness or respectability,” by both consumers and the companies that post the policies on their websites. In Japanese culture, written documents are often considered not to be effective in practice. Table 2. Cross-tabulation between Q9 and Q10 Q10. Do you read a privacy policy when you purchase something online? Q9. Is a privacy policy an important element for your online shopping? 1. Always 2. Almost always 1.Yes 9 2. No Total 3. Sometimes 5. Never 15 64 64 35 187 0 0 9 29 27 65 9 15 73 93 62 252 Table 4. Responses to Q11 Table 3. Cross-tabulation between Q9 and Q12 Q12. Do you believe that companies comply with their privacy policies? 1. All of 2. Some 3. None 4. I have them of them of them no idea Q9. Is a privacy policy an important element for your online shopping? Total Total 4. Almost never Total 1.Yes 8 53 4 115 180 2 .No 4 10 1 49 64 12 63 5 164 244 Q11. Are the privacy policies easy to understand? Answer Rate (%) 1. All of them 0.8 2. Almost all of them 3.9 3. Some of them 16.9 4. A few of them 40.8 5. None of them 12.5 6. I have not read any privacy 14.1 policy 7. I have no idea about this 11.0 3.2 The right to and protection of privacy In this survey, 72.6% of the respondents answered that they did not know what the right to privacy is (Q14; Table 5). Nevertheless, all the respondents, except 16, who answered, “I have no idea about this,” believed that protection of the right to privacy was “very important” or “important” (Q15; Table 6). The respondents’ evaluation of the importance of protecting the right to privacy was independent of their understanding of the concept (Table 7). Why did many respondents not know what the right to privacy is, even though they accepted the importance of protecting it? Many of the students explained in the interviews that they had seen and heard the words of “the right to privacy” and “privacy” and the importance of protecting it in TV news and newspapers. Several students recognised that privacy was related to personal information and explained that “I don’t know what the right to privacy is” meant they were not sure if they completely understood it. Their perception of the importance of protecting the right was based on the fear of personal information disclosure and subsequent problems such as identity theft that have been repeatedly reported by the mass media. We may conclude that their awareness of the importance of protecting the right to privacy has been developed by “hearsay.” Moreover, when asked, “Have you ever investigated the important rights?” all of them answered “no.” Additionally, many of the students considered that their rights, including the right to privacy, were to be preserved by relevant authorities and they did not need to claim protection of their rights. Our assertion that an online privacy policy is just a hygiene factor seems reasonable in light of these observations. Table 5. Knowledge of the right to Table 6. Importance of protecting the right to privacy privacy Q14. Do you know what the right to privacy is? Answer Rate (%) 1. Yes, I know. 27.4 2. I don’t know 72.6 Q15. Is protection of the right to privacy important? Answer n Rate (%) 1. Very important 137 47.9 2. Important 131 45.8 3. Not so important 2 0.7 4. Not important 0 0 5. I have no idea about this 16 5.6 Table 7. Cross-tabulation between Q14 and Q15 Q14. Do you know what the right to privacy is? Total 1. Yes, I know. 2. I don’t know Q15. Is protection of the right to privacy important? 1. Very important or 3. Not so important or 2. Important 4. Not important 77 0 189 2 266 2 Total 77 191 268 3.3 Provision of personal information for online shopping sites The responses to the questions concerning the provision of personal information to online shopping sites are shown in Tables 8–11. More than half of the respondents felt that online shopping sites required too much personal data and requested too much optional information (Tables 8 and 10). When respondents felt that an online shopping site asked for too much personal data, 27% of them provided false information and approximately 20% cancelled the online shopping session or moved to other shopping sites (Table 9). In addition, when they felt that an online shopping site required too much optional personal data, 61.5% chose “Left it blank” and 12.6% provided false information (Table 11). Put simply, many respondents may provide incorrect information to a website or may cancel a session when the website asks for unnecessary personal information. These results indicate that the respondents may in fact recognise the risks of providing personal information. Some students suggested during the interviews that they provided correct personal information to online shopping sites when they felt that the requests for personal information were rational. For example, they had no hesitation in providing their name, address, and telephone number, which are necessary for the sites to deliver goods to their customers. Otherwise, the students might leave “irrational” data fields blank or insert false information in the fields; they did not care about distortions of their Internet identities that might occur as a result of providing false personal information. They lacked knowledge about profiling and therefore tended to underestimate the risks of social sorting based on their Internet identities. For online shopping companies, to set up websites that require personal information that customers consider to be unnecessary or irrational entails significant business risks. The companies may suffer opportunity losses and their personal information databases may contain incorrect data. The trustworthiness of the companies may also be undermined. Table 8. Personal data items required by online shopping sites Q16 .Have you ever felt that online shopping sites require too much personal data? Answer Rate (%) 1. Yes 57.5 2. No 42.5 Table 9. Reactions to the requirement for too much personal data by online shopping sites Q16-1. If "yes," what did you do? Answer 1. Provided information 2. Provided false information 3. Went elsewhere 4. Cancelled the shopping Rate (%) 50.9 27.0 12.9 9.2 Table 10. Optional personal data items on online shopping sites Table 11. Reactions to requests for too much optional personal data by online shopping sites Q17. Have you ever felt that online shopping sites request too much optional personal data? Q17-1. If "yes", what did you do? Answer 1. Yes 2. No Rate (%) 50.2 49.8 Answer 1. Provided information 2. Provided false information 3. Left it blank 4. Went elsewhere 5. Cancelled the shopping Rate (%) 17.5 12.6 61.5 4.2 4.2 3.4 Knowledge of technology and schemes concerning online privacy In general, those who acknowledge the importance of protecting the right to privacy can be expected to be interested in technology regarding online privacy. However, many of the respondents, almost all of who were aware of the importance of privacy protection, did not have the expected knowledge about the technology related to online privacy. For example, 63% of respondents did not understand the concept of opting out very well. Cookies, a technological threat to online privacy, were understood by only 19.8% (Tables 12 and 13). In contrast, approximately half of the respondents had some knowledge of Secure Sockets Layer (SSL) and phishing (Tables 14 and 15). Privacy and security seals were not recognised by the respondents. We expected the respondents to know the Privacy Mark because it is authorised by the Japan Information Processing Development Corporation (JIPDEC) and is displayed by many Japanese online shopping sites. However, 82.3% did not know it. Other seals such as Trust-e, thawte, and BBB online were also not well known. However, 37.6% of the respondents had at least seen the VeriSign seal (Table 16). Acquiring the Privacy Mark may not be worthwhile for Japanese B to C e-commerce companies because of its high cost. JIPDEC and online shopping companies should reconsider the role of the Privacy Mark in the Japanese B to C e-commerce market. Table 12. Opt-out Table 13. Cookies Q13. When the opportunity of “opting out” is provided in a privacy policy, do you require not providing your personal data to third-party organisations? Answer Rate (%) 1. Always 17.1 2. Sometimes 10.6 3. Never 9.3 4. I have no idea 63.0 Q18. Do you understand about cookies? Table 14. Secure Sockets Layer Table 15. Phishing Q19. Do you understand the meaning of the padlock symbol often shown on your browser when you visit online shopping sites? Answer Rate (%) 1. Yes 43.6 2. No 56.4 Q20. Do you understand what phishing is? Answer 1. Yes 2. No Answer 1. Yes 2. No Rate (%) 19.8 80.2 Rate (%) 44.6 55.4 Table 16. Privacy and security seals Q21. Do you recognise the following seals? If so, what do they represent? Q21-1. Privacy Mark Answer 1. Yes, I know what this means. 2. I have seen this, but don't know what the seal it is. 3. I don't know this seal. Q21-5. VeriSign Rate (%) 1.9 15.4 82.8 Answer 1. Yes, I know what this means. 2. I have seen this, but don't know what the seal it is. 3. I don't know this seal. Rate (%) 1.1 36.5 62.4 4 Implications for Japanese society and online business The Japanese B to C e-commerce market amounted to approximately 4.4 trillion yen in 2006. Online shopping has already taken root in Japanese society, and the increase in online transactions is expected to continue. This means that secure personal information handling, as well as the implementation of appropriate privacy protection policies in Japanese e-business industry, has become an urgent issue. However, the indifference of Japanese consumers to online privacy protection and the lack of knowledge concerning the right to privacy are obstacles to the successful development of Japanese online business and society. Acquiring the Privacy Mark has become an effective measure for business-to-business (B to B) e-commerce companies that do business with other organisations in Japan, where the 2005 Act for the Protection of Personal Information regulates the collection, use, and sharing of personal information in organisations. Business and governmental organisations that wish to outsource personal information handling tend to require that the outsourced companies obtain the Privacy Mark. However, if a B to C company’s efforts to protect the privacy of its clients is not appreciated by those clients because of their indifference, then the company may consider such efforts to be costly and unnecessary and would be discouraged from continuing or extending its efforts. That would certainly be reasonable given our results. If the situation is left as it is, the Japanese B to C e-commerce market may become similar to Akerlof’s market for lemons [Akerlof, 1970] in terms of fair personal data handling. Here, the asymmetry of information with respect to B to C e-commerce company behaviour would be caused and/or enhanced by the indifference of individual consumers. Accurate knowledge about the right to privacy and the importance of protecting it, as well as information on technology related to privacy protection, should be shared among the Japanese people to prevent this unfortunate situation. The disclosure of company information to the public is another effective means of prevention. Methods for sharing shopping company track records for personal information handling made may be useful. For example, word-of-mouth/mouse websites would allow consumers to share information on which companies are dependable. 5 Conclusions and future research We used a survey to explore the attitude of young Japanese people towards online privacy as customers of online shopping sites. Although Japanese people are reputed to be generally sensitive to the importance of protecting privacy and personal data, the survey results show that this is not necessarily the case. The survey results and subsequent discussions led to the development of some possible measures to improve the effectiveness of online privacy policies and schemes to protect the right to privacy. This study is the first step in a comparative analysis that considers local socio-cultural factors. A similar investigation and survey is being done in the UK to achieve the objectives of our cross-cultural research project. Moreover, it would be interesting and useful to conduct the same survey in other countries such as China and Korea, as well as other European countries, to compare the perspectives on privacy online between the East and West, as well as among various countries in the East and West. Acknowledgements This study was part of an open research centre project for private universities entitled “Quality-oriented Human Resource Development and Smart Business Collaboration: Quality Management Science,” with a matching fund subsidy provided by the Japanese Ministry of Education, Culture, Sports, Science, and Technology, for the period 2007–2012. References Akerlof, G. A. (1970), The market for ‘lemons’: quality uncertainty and the market mechanism, Quarterly Journal of Economics, 84(3), 488–500. McRobb, S., Orito, Y., Murata, K., and Adams, A. A. (2007), Towards an explanation of cross-cultural factors in privacy online, Proceedings of ETHICOMP 2007, 380–385. Pollach, I. (2007), What’s wrong with online privacy policies? , Communications of the ACM, 50(9), 103–108. Appendix 1: Questionnaire Online Shopping Survey This questionnaire investigates the characteristics of the online shopping behaviour of young people as part of an international comparative study. Many people enjoy online shopping using personal computers and/or mobile phones. A variety of services are provided online, including booking train/bus/airplane tickets, booking theatre tickets, and buying books and food. The aim of this survey is to analyse the relationship between online shopping behaviour and local culture. Responding to this questionnaire will not result in the specific identification of any individual, and the results of the survey will not be used for any purposes other than those described here. Cover sheet Questions 1. Have you ever accessed the Internet? 2. How long have you used the Internet? 3. What device do you mainly use to access the Internet, a personal computer or a mobile phone? 4. Have you ever purchased anything from online shopping sites? 4-1. If "no," why haven't you purchased anything online? 5. What device do you mainly use to do online shopping, a personal computer or a mobile phone? 6. How often do you purchase something online, on average? 7. Please provide the average price range of goods that you purchase online. 8. Do you know that the privacy policy is posted on every online shopping site? 9. Is a privacy policy an important element for your online shopping? 10. Do you read a privacy policy when you purchase something online? 11. Are the privacy policies easy to understand? 12. Do you believe that companies comply with their privacy policies? 13. When the opportunity of opting out is provided in a privacy policy, do you require not providing your personal data to third-party organisations? 14. Do you know what the right to privacy is? 15. Is protection of the right to privacy important? 15-1. Why do you think that? 16. Have you ever felt that online shopping sites require too much personal data? 16-1. If "yes," what did you do? Age group, gender, occupation, latest educational status 1.Yes 2. No → end of this questionnaire 1. Less than one year 2. 1–5 years 3. 6–10 years 4. More than 10 years 1. Personal computer 2. Mobile phone 1.Yes 2. No → 4-1 → end of questionnaire 1. It is technologically difficult for me to shop online. 2. I don't understand shopping online. 3. There is nothing I want to purchase online. 4. I don't like to take risks with online payment and/or receipt of goods. 5. I don't like to take risks with unauthorised access to and misuse of my personal data. 6. other → Specify [ ] 1. Personal computer 2. Mobile phone 1. Every day 2. Three times per week 3. Once per week 4. Twice per month 5. Once per month 6. Once every three months 7. Ones per half year 8. Once per year 9. Other → Specify [ ] 1. Less than JPY 10,000 2. JPY 10,000–20,000 3. More than JPY 20,000 1. Yes 2. No → Skip to Q14 1. Yes 2. No 1. Always 2. Almost always 3. Sometimes 4. Almost never 5. Never 1. All of them 2. Almost all of them 3. Some of them 4. A few of them 5. None of them 6. I have not read any privacy policy 7. I have no idea about this 1. All of them 2. Some of them 3. None of them 4. I have no idea 1. Always 2. Sometimes 3. Never 4. I have no idea 1. Yes, I know. → Q14-1 Specify [ ] 2. I have no idea. 1. Very important 2. Important 3. Not so important 4. Not important 5. I have no idea Specify [ ] 1. Yes 2. No 1. Provided information 2. Provided false information 3. Went elsewhere 4. Cancelled the shopping 17. Have you ever felt that online shopping sites request too much optional personal data? 17-1. If "yes," what did you do? 18. Do you understand about cookies? 18-1. If “yes”, have you changed default setting of the browser for handling cookies? 19. Do you understand the meaning of the padlock symbol often shown on your browser when you visit online shopping sites? 20. Do you understand what phishing is? 21. Do you recognise the following seals? If so, what do they represent? 21-1 21-3 21-2 21-4 21-5 1. Yes 2. No 1. Provided information 2. Provided false information 3. Left it blank 4. Went elsewhere 5. Cancelled the shopping 1. Yes 2. No 1. Yes 2. No 1. Yes 2. No 1. Yes 2. No 1. Yes, I know what this means → [ 2. I have seen this, but don't know what seal it is. 3. I don't know this seal. ]