Understanding Data Breach Information: How lay Individuals Interpret Breach Notifications

Abstract

This thesis investigates how lay individuals interpret and respond to current data breach notifications(DBNs). By demonstrating DBN as a new form of accounting information, this thesis calls for “rethinking expertise” (Collins & Evans, 2019) in accounting information use and extends the current literature from professional users to lay users in the context of data breaches. Central to this research is the question of how ambiguities within current DBNs exacerbate the vulnerability and interpretation challenges lay individuals face. Drawing on Ellsberg’s ambiguity aversion theory (1961), this thesis employs phenomenological interviews to capture nuanced subjective interpretations and qualitative experiments to further assess lay individuals’ preferences in the face of ambiguity in DBNs. Findings reveal that current DBNs are largely ineffective, characterised by substantial ambiguities that hinder lay individuals’ interpretation. As a result, lay individuals prefer to adopt a rational “protective” strategy to prioritise clarity over negativity in breach information. Moreover, the thesis identifies a “power dynamic” (Carr & Beck, 2022) between DBN providers (breached organisations) and recipients (lay individuals), highlighting the critical need to amplify lay individuals’ voices in breach disclosure practices. Based on empirical insights, the thesis provides practical recommendations for individuals, organisations, and policymakers to reduce ambiguity in current DBNs and proposes a framework for more effective breach disclosures that empower lay users and promote greater accountability in the aftermath of data breaches.