A Tool for Privacy Culture Assessment

      Raphael Batista Ribeiro^*, João Souza Neto, 

Tomás Roberto Cotta Orlandi, Rodrigo de Andrade Lima Orlandi

Universidade Católica de Brasília, Brasília-Brazil

IEEE Senior Member, Brasília-Brazil

Universidade de Brasília-UNB, Brasília-Brazil

Universidade de Brasília-UNB/FGA, Brasília-Brazil

Abstract: 

This research proposes an organizational culture assessment tool so that institutions can diagnose and develop a privacy culture. For the established objective to be achieved, this research included both a survey and an assessment, along with 100 market professionals, of the requirements considered a survey and an assessment, along with 100 market professionals, of the requirements necessary for developing a privacy culture. In addition, an organizational culture assessment was carried out in 06 organizations utilizing the suggested tool, the OCAI questionnaire, created by Cameron and Quinn (2011). The assessment allows for knowledge about the organization’s cultural levels, including the current perception of the dominant culture and the future status to be achieved. The results indicated the possibility of using the OCAI to assess the culture of privacy and provided 13 requirements that help in the development of this culture in organizations. As In future work, the author recommends the OCAI form’s application of the OCAI form within organizations through a case study, with wide dissemination to employees or servers. Furthermore, it is important to evaluate the effectiveness of this research’s identified requirements and verify whether they contribute to the desired state’s achievement according to the intended types of culture.

Keywords: Organizational Culture, Data Privacy, Privacy Culture

 

The concept of privacy points to several elements, such as the search for equality, freedom of choice, and the desire not to be discriminated against. Privacy is linked to personality and its development, thus forming a complex web of relationships under constant study by law (Doneda, 2021).

In Brazil, privacy is based on Law nº 13.709/18, which provides for the processing of personal data of Brazilian citizens and aims to protect the fundamental rights of freedom and privacy and the free development of the personality of the natural person (Brasil, 2018).

This research relates privacy to organizational culture, defined by Schein and Schein (2022) as a set of basic assumptions that a group invented, discovered or developed when learning how to deal with the problems of external adaptation and internal integration problems. Oliveira and Silva (2012) corroborate Schein's idea by defining organizational culture as a system of beliefs and values that develop within the organization and guide the behavior of its members. These authors also claim that organizational culture works as a force that drives and shapes behaviors, reinforces beliefs, and serves as a stimulus for organization members to apply their efforts to achieve common goals.

Therefore, organizational culture is related to privacy through attitudes, assumptions, beliefs, values, and knowledge practiced by an organization's employees, thus contributing to data protection and, consequently, to the formation of a privacy culture (Da Veiga & Martins, 2015).

The present research aims to propose an instrument for evaluating the privacy culture of organizations through the OCAI tool, which allows diagnosing the organizational culture profile, helping to identify the type of culture that has more dominance in the organization, according to the Competitive Values Model proposed by Cameron and Quinn (2011), and in directing changes and adaptations to be carried out to achieve a desired state.

Survey Requirements

The research's first stage is identifying the necessary requirements for a privacy culture’s development. Knowledge of the requirements is essential to allow an assessment of the organization's culture, directing efforts to the improvement of the intended requirements and, consequently, achieving the intended goals.

The requirements listed in Table 1, which were organized alphabetically, were identified from articles and information from government websites, such as the Federal Data Processing Service - SERPRO (2020). The studies by Power (2007), Da Veiga (2018), Da Veiga and Martins (2015), Da Veiga and Martins (2014), and Swartz et al. (2021) on privacy culture and information security culture contributed to the survey of requirements.

Survey Application For Requirements Assessment

The survey application stage, the research’s second stage, aimed to assess the necessary requirements for developing a privacy culture among professionals in Brazilian organizations. In addition to the goal established for this step, the author took the opportunity to verify the compliance status of organizations with some elements required in the Brazilian GPDPL (General Personal Data Protection Law).

 

Table 1

Requirements for the Development of a Culture of Privacy

1	Senior Management support
2	Meeting customer privacy expectations
3	Commitment of managers
4	Privacy risk communication
5	Ethical conduct
6	Regulatory compliance
7	Privacy awareness
8	Lessons learned
9	Security measures
10	Institutional policies and standards
11	Accountability to customers
12	Data processing
13	Training and capacity building
14	Values ​​and beliefs

Source: elaborated by the authors.

     The survey was applied online with help from the Microsoft Forms tool. The form was released on the social network LinkedIn and in market professionals’ groups on the WhatsApp app on April 20, 2021. No participant’s personal data was collected. This stage of the research involved 100 professionals who answered the survey prepared by the author.

This stage’s main result is shown in Figure 1, in which participants designated the importance level of each requirement identified as essential for the development of a privacy culture, according to each respondent’s experience and knowledge. When consolidating the 'important' and 'very important' percentages of the requirements, it is observable that they were left with a percentage higher than 80%. Therefore, the requirements identified by the author were evaluated as important by the survey.

In addition to the result shown in Figure 1, the participants were asked if all the requirements for the development of a privacy culture were present in the list. If not, a free text field was enabled so that the respondent could enter the missing requirement. Of the 100 people participating in the survey, 12 included their suggestions. The author identified two contributions, namely: public manifestation by the Senior Management and the privacy program.

Clark and Culnan (2009) report that a privacy program is essential to maintaining a culture focused on compliance and integrity. In addition, the authors emphasize that the culture of privacy must have the senior management’s moral support, encouraging managers to fulfill their data protection and privacy responsibilities. The Law nº 13.709 (2018) establishes the creation of a privacy program in favor of data protection.

 

Figure 1

Requirements’ Importance Level

Source: elaborated by the authors

After a final analysis by this research’s author, the requirements 'lessons learned', 'safety measures', and 'data treatment' were removed from the final list of requirements, as can be seen in Table 2, as they are operational activities. According to Oliveira and Silva (2012), organizational culture drives people's behavior, stimulating their efforts to achieve the intended goals. Therefore, the requirements for developing a privacy culture, as long as they are applied within the organization, improve the quality of operations.

 

Table 2

Final Requirements for the Development of a Culture of Privacy

Requisitos Finals
1	Senior Management support
2	Meeting customer privacy expectations
3	Commitment of managers
4	Privacy risk communication
5	Ethical conduct
6	Regulatory compliance
7	Privacy awareness
8	Public manifestation of the senior management
9	Institutional policies and standards
10	Accountability to customers
11	Privacy program
12	Training and capacity building
13	Values ​​and beliefs

Source: elaborated by the authors.

 

Requirements’ Relationship with the Competitive Values Model

The relationship between the privacy culture’s requirements and the Competitive Values ​​Model represents the research’s third stage. The technique of comparing cultural requirements with the Competitive Values Model is presented by Barros (2018) in his research on organizational culture assessment for DevOps implementation.

After consolidating the first stage’s results, as seen in Table 2, the final requirements were compared with the organizational aspects of the model proposed by Cameron and Quinn (2011) The result of this comparison is shown in Table 3.

 

Table 3

Requirements Included in the Competitive Values ​​Model

Flexibility and Discretion
Internal Focus and Integration	Clan (A) ·        Ethical conduct. ·        Privacy awareness. ·        Training and capacity building. ·        Values and beliefs.	Adhocracy (B) ·        Senior Management support. ·        Commitment of managers. ·        Public manifestation of the senior management.	External Focus and Differentiation
	Hierarchy (D) ·        Privacy risk communication. ·        Regulatory compliance. ·        Institutional policies and standards. ·        Privacy program.	Market (C) ·        Meeting customer privacy expectations. ·        Accountability to customers.
Stability and Control

Source: elaborated by the authors.

 

The types of culture’s characteristics, such as orientation, type of leader, key-value, and theory of associated effectiveness, were used in the comparative analysis carried out by this research’s author. This analysis presents the organization with the possibility of knowing the necessary requirements to develop the intended privacy culture.

Regarding the Clan culture type, the listed requirements were: (I) ethical conduct, (II) privacy awareness, (III) training and building capacity, and (IV) values ​​and beliefs. These requirements were associated with this cultural type since they are based on the development of people from an organization as the key to success. The commitment and duty of people are also treated as fundamental issues that guide the organization in the collaborative model and produce the expected efficacy.

Regarding the Adhocracy culture type, the listed requirements were: (I) Senior Management support, (II) managers’ commitment, and (III) public manifestation by the Senior Management. These requirements were associated with this culture type by placing leadership as a fundamental role for success in creating innovative products and services. Leaders are primarily responsible for guiding the organization in the creative model and producing the desired effectiveness.

The requirements related to Market culture were (I) meeting clients’ privacy expectations and (II) client accountability. These requirements were associated with this culture type due to the focus on the client as a premise for success. Consequently, meeting the demands offered to the public is also treated as a priority issue. The client is primarily responsible for guiding the organization in the competitive model and producing the expected effectiveness, as their expectations are put first to achieve success.

For the Hierarchical culture type, the requirements listed were as follows: (I) communication of privacy risks; (II) regulatory compliance; (III) institutional policies and norms; and (IV) privacy program. These requirements were associated with this culture type because the hierarchy model is established as the key to success, where resources, responsibilities, processes, tasks, predictability, stability, procedures, and organizational activities are treated as priorities by the organization to achieve the desired efficacy.

Assessment of Privacy Culture in Organizations

Oliveira and Silva (2012) describe organizational culture as a system of beliefs and values ​​that develops within the organization and guides the behavior of its members. Therefore, it is up to organizations to define the culture type they want to achieve, prioritize one type over another, or even develop a balance between them.

The assessment of organizational culture, the research’s fourth and last stage, was carried out utilizing the OCAI form designed by Cameron and Quinn (2011), as can be seen in Table 4. The form was created with the help of the Microsoft Excel program and sent on July 6, 2021, to six Brazilian organizations’ employees and federal workers, totaling 20 respondents.

The OCAI form assesses six dimensions by means of a scale in which the respondent divides 100 points between four alternatives per dimension. It is necessary to split 100 points for the current state of the organization's culture and another 100 points for the desired future state. Each of the four alternatives represents a culture type in the Competitive Values ​​Model, namely: A (Clan Culture), B (Adhocracy Culture), C (Market Culture), and D (Hierarchical Culture). There are no right or wrong answers, just as there is no right or wrong culture (Cameron & Quinn, 2011).

 

Table 4

Organizational Culture Assessment Instrument (OCAI)

1	Dominant features of a culture of privacy	Now	Preferred
A	The organization is a very personal place. It is like an extended family. People seem to share a lot of themselves.
B	The organization is a very dynamic entrepreneurial place. People are willing to stick out their necks out and take risks
C	The organization is very result oriented. A major concern is with getting the job done. People are very competitive and achievement oriented.
D	The organization is a very controlled and structured place. Formal procedures generally govern what people do.
2	Organizational leadership to promote a culture of privacy	Now	Preferred
A	The leadership in the organization is generally considered to exemplify mentoring, facilitating, or nurturing
B	The leadership in the organization is generally considered to exemplify entrepreneurship, innovation, or risk taking
C	The leadership in the organization is generally considered to exemplify a no-nonsense, aggressive, results-oriented focus
D	The leadership in the organization is generally considered to exemplify coordinating, organizing, or smooth-running efficiency.
3	Managing employees in a culture of privacy	Now	Preferred
A	The management style in the organization is characterized by teamwork, consensus, and participation.
B	The management style in the organization is characterized by individual risk taking, innovation, freedom, and uniqueness.
C	The management style in the organization is characterized by hard-driving competitiveness, high demands, and achievement.
D	The management style in the organization is characterized by security of employment, conformity, predictability, and stability in relationships
4	Integration of the organization into the culture of privacy	Now	Preferred
A	The glue that holds the organization together is loyalty and mutual trust. Commitment to this organization runs high.
B	The glue that holds the organization together is commitment to innovation and development. There is an emphasis on being on the cutting edge.
C	The glue that holds the organization together is an emphasis on achievement and goal accomplishment. Aggressiveness and winning are common themes.
D	The glue that holds the organization together is formal rules and policies. Maintaining a smooth-running organization is important.
5	Strategic Emphasis on Privacy Culture	Now	Preferred
A	The organization emphasizes human development. High trust, openness, and participation persist.
B	The organization emphasizes acquiring new resources and creating new challenges. Trying new things and prospecting for opportunities are valued.
C	The organization emphasizes competitive actions and achievement. Hitting stretch targets and winning in the marketplace are dominant.
D	The organization emphasizes permanence and stability. Efficiency, control and smooth operations are important.
6	Success criteria for a culture of privacy	Now	Preferred
A	The organization defines success on the basis of development of human resources, teamwork, employee commitment, and concern for people.
B	The organization defines success on the basis of having unique or newest products. It is a product leader and innovator.
C	The organization defines success on the basis of winning in the marketplace and outpacing the competition. Competitive market leadership is key.
D	The organization defines success on the basis of efficiency. Dependable delivery, smooth scheduling and low-cost production are critical.

      Source: Cameron & Quinn (2011) adapted by the authors.

 The evaluation of the OCAI form allows knowledge of the organization’s cultural levels, including the current perception of the dominant culture and the intended status to reach. Percentages were calculated utilizing arithmetic mean, and it is necessary to calculate the current and the desired state. As an example, the calculation formula for Clan culture (A) is presented below.

Organization 1 – Banking Institution

The result of applying the Assessment Instrument - OCAI in the Banking Institution is presented in Table 5.

 

Table 5

Score of Organization #1 – Banking Institution

Status	A (Clan)	B (Adhocracy)	C (Market)	D (Hierarchy)
Now	22.74	18.81	28.10	30.36
Preferred	24.52	25.95	25.83	23.69

Source: elaborated by the authors.

 

According to the result, the Banking Institution’s predominant culture is the Hierarchical type (30,36) and the second type of predominant culture is the Market type (28,10).

When comparing the status with the desired one, the Adhocracy culture had the greatest variation among the other cultures, with an increase of 7.14 points; the Hierarchical culture had the second greatest variation, with a decrease of 6.63 points. The Market culture type decreased by 2.27, and the Clan culture increased by 1.78 points.

The result of the desired state shows a balance between the four cultures, except for a slight advantage for the Adhocracy culture type.

Figure 2 shows the Banking Institution's organizational culture profile according to the Competitive Values Model.

 

Figure 2

Culture Profile of Organization #1 – Banking Institution

  Source: elaborated by the authors.

 

Organization 2 – Research Foundation

The result of applying the Assessment Instrument – OCAI in the Research Foundation is presented in Table 6.

  

Table 6

Score Of Organization #2 – Research Foundation

Status	A (Clan)	B (Adhocracy)	C (Market)	D (Hierarchy)
Now	20.00	0.00	0.00	80.00
Preferred	18.33	1.67	1.67	78.33

Source: elaborated by the authors.

 

According to the result, the Research Foundation’s predominant culture is the Hierarchical type (80.00), and the second predominant culture type is the Clan type (20.00).

Comparing the status with the desired one, it can be seen that the four cultures had the same variation of 1.67 points. The Clan and Hierarchical cultures decreased while the Adhocracy and Market cultures increased.

It can be seen from the desired state’s result that the Hierarchical and Clan cultures remain dominant, with 78.33 and 18.33 points, respectively.

Figure 3 shows the Research Foundation's organizational culture profile according to the Competitive Values Model.

 

Figure 3

Culture Profile of Organization #2 - Research Foundation

Source: elaborated by the authors.

 

 Organization 3 – Public Company

The result of applying the Assessment Instrument - OCAI in the Public Company is presented in Table 7.

 

Table 7

Score of Organization #3 – Public Company

Status	A (Clan)	B (Adhocracy)	C (Market)	D (Hierarchy)
Now	16.53	14.17	20.47	48.83
Preferred	24.50	25.44	29.78	20.28

Source: elaborated by the authors.

According to the result, the Public Company’s predominant culture is the Hierarchical type (48.83), and the second predominant culture type is the Market type (20.47).

Comparing the current status with the desired one, it can be seen that the Hierarchical culture had the greatest variation among the other cultures, with a decrease of 28.56 points; the Adhocracy culture had the second greatest variation, with an increase of 11.28 points. The Market culture had an increase of 9.31, and the Clan culture type had an increase of 7.97 points.

It can be seen from the desired state’s result that the Market culture represents the highest level of dominance within the organizational culture, while the Hierarchical culture reduces its position to the 4th level of dominance if compared to the current state.

Figure 4 shows the Public Company’s organizational culture profile according to the Competitive Values ​​Model.

 

Figure 4

Culture Profile of Organization #3 - Public Company

Source: elaborated by the authors. 

Organization 4 - Civil Association

The result of applying the Assessment Instrument - OCAI in the Civil Association is presented in Table 8.

 

Table 8

Score of Organization #4 - Civil Association

Source: elaborated by the authors.

 

According to the result, the Civil Association’s predominant culture is the Hierarchical type (53.33), and the second predominant culture type is the Clan type (35.00).

When comparing the current status with the desired one, it can be seen that the Hierarchical culture had the greatest variation among other cultures, with a decrease of 18.33 points; the Market culture had the second greatest variation, with an increase of 17.50 points. The Adhocracy culture had an increase of 15.00, and the Clan culture type decreased by 14.17 points.

It can be seen from the desired state’s result that the Hierarchical culture continues to represent the highest level of dominance within the organizational culture, while the Market and Adhocracy cultures receive greater prominence than the current state.

Figure 5 shows the Civil Association's organizational culture profile according to the Competitive Values ​​Model.

 

Figure 5

Culture Profile of Organization #4 - Civil Association

Source: elaborated by the authors. 

Organization 5 - Social Institution

The result of applying the Assessment Instrument - OCAI in the Social Institutions is presented in Table 9.

 

Table 9

Score of Organization #5 - Social Institution

Status	A (Clan)	B (Adhocracy)	C (Market)	D (Hierarchy)
Now	21.46	24.79	24.58	28.75
Preferred	27.29	19.38	25.00	28.33

Source: elaborated by the authors.

 

According to the result, the predominant culture of social institutions is the hierarchical type (28.75), and the second predominant culture type is the adhocracy type (24.79).

Comparing the current status with the desired one, it can be seen that the Clan culture had the greatest variation among the other cultures, with an increase of 5.83 points; the Adhocracy culture had the second greatest variation, with a decrease of 5.42 points. The Market culture type had an increase of .42, and the Hierarchical culture had a decrease of .42 points.

It can be seen from the desired state’s result that the Hierarchical culture continues to represent the highest level of dominance within the organizational culture, while the Clan culture receives greater prominence than the current state.

Figure 6 shows the Social Institution’s organizational culture profile according to the Competitive Values ​​Model.

 

Figure 6

Culture Profile of Organization #5 – Social Institution

Source: elaborated by the authors. 

Organization 6 - Federal Agency

The result of applying the Assessment Instrument - OCAI in the Federal Agency is presented in Table 10.

 

Table 10

Score of Organization #6 - Federal Agency

Status	A (Clan)	B (Adhocracy)	C (Market)	D (Hierarchy)
Now	16.67	18.33	30.00	35.00
Preferred	20.83	25.00	36.67	17.50

Source: elaborated by the authors.

 

According to the result, the Federal Agency’s predominant culture is the Hierarchical type (35.00), and the second type of predominant culture is the Market type (30.00).

Comparing the current status with the desired one, it can be seen that the Hierarchical culture had the greatest variation among other cultures, with a decrease of 17.50 points; the Market and Adhocracy cultures had the second greatest variation, with an increase of 6.67 points each. Clan culture had an increase of 4.17 points.

It can be seen from the result of the desired state that the Market culture represents the highest level of dominance within the organizational culture, while the Hierarchical culture reduces its position to the 4th level of dominance if compared to the current state.

Figure 7 shows the Federal Agency’s organizational culture profile according to the Competitive Values ​​Model.

 

Figure 7

Culture Profile of Organization #6 - Federal Agency

Source: elaborated by the authors. 

Conclusion

This research’s objective of proposing an organizational culture assessment tool to help institutions diagnose and develop the privacy culture was met by applying the OCAI form.

Even in a preliminary fashion, this research presented directions for achieving the desired future state, considering the comparative analysis carried out between the 13 requirements of the privacy culture and the culture types of the Competitive Values Model. Depending on the culture to be developed, whether it is Clan, Adhocracy, Market and/or Hierarchical, this research indicated which requirements must be observed and treated within the organization according to the intended objectives.

Only three scientific publications were identified that address the essential elements and characteristics for a privacy culture’s development, representing a very small sample for the requirements’ identification. It is noticeable that the subject is discussed little academically. More researchers need to show interest in this topic in order to strengthen scientific discussion.

The sample of respondents to the OCAI form represents a small number, considering the size of the organizations evaluated. It is likely that the evaluations’ results would have indicated different culture levels from those calculated if the sample had been larger. To have a more accurate assessment, it is important that a dedicated application with a broader target audience is carried out in an organization.

It is recommended that the OCAI form be applied in an organization, with wide dissemination to employees or federal workers, through a case study. Furthermore, the author suggests an evaluation of the 13 requirements’ efficacy identified in this research to verify whether they contribute to the desired state’s achievement according to the future desired culture types. 

Reference

Barros, A. R. C. (2018). Avaliação da Cultura Organizacional para a Implantação de Devops. [Dissertação do Mestrado em Gestão do Conhecimento e da Tecnologia da Informação]. [Assessment of organizational culture for the implementation of devops]. [Master's thesis in Knowledge Management and Information Technology] – Universidade Católica de Brasília (UCB), Brasília – DF.

Brasil. Lei nº 13.709, de 14 de agosto de 2018 (2018). Portal do Governo Federal, 2018. Disponível em: http://www.planalto.gov.br/ccivil03/ato2015-2018/2018/lei/l13709.htm

Cameron, K. S., & Quinn, R. E. (2011). Diagnosing and changing organizational culture: Based on the competing values framework (3rd ed.). San Francisco: Jossey-Bass.

Clark, C. E., & Culnan, M. J. (2009). How ethics can enhance organizational privacy: Lessons from the Choicepoint and TJX Data Breaches. Mis Quarterly: Management Information Systems, 33(4), 673–687. http://dx.doi.org/10.2307/20650322

Como Incentivar um Comportamento em prol da Proteção de Dados [How to Encourage Data Protection Behavior]. SERPRO (2020). Disponível em: https://www.serpro.gov.br/lgpd/noticias/2020/cultura-privacidade-lgpd-governanca

Da Veiga, A. (2018). An information Privacy Culture Instrument to Measure Consumer Privacy Expectations and Confidence. Information and Computer Security, 26(3), 338–364. https://doi.org/10.1108/ICS-03-2018-0036

Da Veiga, A., & Martins, N. (2014). The value of using a validated information security culture instrument. Proceedings of the 8th European Conference on Information Management and Evaluation (pp. 146-154). http://dx.doi.org/10.13140/2.1.2283.9049

Da Veiga, A., & Martins, N. (2015). Information security culture and information protection culture: A validated assessment instrument. Computer Law and Security Review, 31(2), 243–256. http://dx.doi.org/10.1016/j.clsr.2015.01.005

Doneda, D. (2021). Da privacidade à proteção de dados pessoais: Fundamentos da lei geral de proteção de dados [From privacy to personal data protection: Fundamentals of the general data protection law]. Ed. São Paulo: Revista dos Tribunais.

Oliveira, J. F., & Silva, E. A. (2012). Gestão organizacional: Descobrindo a chave de sucesso para os negócios [Organizational management: Discovering the key to success for business]. Ed. São Paulo: Saraiva.

Power, E. M. (2007). Developing a Culture of Privacy: a Case Study. IEEE Security and Privacy Magazine, 5(6), 58–60. http://dx.doi.org/10.1109/MSP.2007.163

Schein, E. H., & Schein P. (2022). Organizational culture and leadership. Ed. Atlas.

Swartz, P., Da Veiga, A., & Martins, N. (2021). Validating an information privacy governance questionnaire to measure the perception of employees. Information & Computer Security, 29(5), 761–786. https://doi.org/10.1108/ICS-08-2020-0135