"My Privacy for their Security": Employees' Privacy Perspectives and Expectations when using Enterprise Security Software
Jonah Stegman, Patrick J. Trottier, Caroline Hillier, Hassan Khan,, Mohammad Mannan

TL;DR
This study explores employees' privacy perceptions regarding enterprise security software, revealing communication gaps and misconceptions that impact trust, and proposes design improvements for privacy notices and indicators.
Contribution
It provides empirical insights into employee privacy perceptions and misconceptions about ESS data collection, highlighting communication issues and proposing design solutions.
Findings
Many employees lack information about data collection.
Employees underestimate the scope of data collected.
Poor communication erodes trust in ESS.
Abstract
Employees are often required to use Enterprise Security Software ("ESS") on corporate and personal devices. ESS products collect users' activity data including users' location, applications used, and websites visited - operating from employees' device to the cloud. To the best of our knowledge, the privacy implications of this data collection have yet to be explored. We conduct an online survey (n=258) and a semi-structured interview (n=22) with ESS users to understand their privacy perceptions, the challenges they face when using ESS, and the ways they try to overcome those challenges. We found that while many participants reported receiving no information about what data their ESS collected, those who received some information often underestimated what was collected. Employees reported lack of communication about various data collection aspects including: the entities with access to…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsPrivacy, Security, and Data Protection · Technology Adoption and User Behaviour · Knowledge Management and Sharing
