A study on factors affecting privacy risk tolerance to prevent the spread of COVID-19 in South Korea.

South Korea has been evaluated as a country that is responding well to COVID-19. The Government of the Republic of Korea discloses where, when, and by which means of transportation people confirmed to have the virus have visited. Although disclosure of movement has contributed to flattening the curve and providing timely medical service, concerns about privacy infringement have also been raised. This article determines what factors influence privacy risk tolerance, looking specifically at threat severity, vulnerability, response efficacy, and response cost. We also provide implications for the preparation of better countermeasures for the government to implement.

South Korea’s response to COVID-19

COVID-19 has brought unprecedented challenges around the world. The World Health Organization recently said that roughly 1 in 10 people worldwide may have been infected by the coronavirus (Tuemmler et al., 2020). Since the pandemic started, each country has made efforts to prevent further spread of COVID-19. According to a UN report, South Korea has managed COVID-19 most effectively (Sachs et al., 2020). One of the country’s practices that made it possible to suppress transmission was isolating infected individuals and tracing the people who came in contact with them (Ministry of the Interior and Safety, 2020). To improve the accuracy of epidemiological investigation, contact tracing can be conducted by tracking credit card transaction records, CCTV footage, and mobile phone GPS data, all within the scope permitted by the Infectious Disease Control and Prevention Act (Government of the Republic of Korea, 2020a). Through this investigative process, the South Korean government discloses where, when, and by which means of transportation the confirmed people have visited (Government of the Republic of Korea, 2020a). This movement record helps the general public know whether they have been in contact with confirmed cases and take necessary steps to protect themselves and minimize further spread of the virus (Government of the Republic of Korea, 2020b).

Close contacts identified by epidemiological investigations are subject to self-quarantine, and their compliance with guidelines and health status is monitored (Government of the Republic of Korea, 2020a). With the GPS-based self-quarantine safety protection app developed by the government, people who are under quarantine are monitored to ensure they remain in their preregistered quarantined area (Ahn, 2020). This app automatically alerts both users and government officers when people who are under quarantine leave their preregistered areas (Government of the Republic of Korea, 2020a).

Although the tracking and disclosure of movement records have contributed to flattening the curve and providing timely medical service (Government of the Republic of Korea, 2020b), concerns about privacy infringement have also been raised (Government of the Republic of Korea, 2020a; Joo & Shin, 2020; Zastrow, 2020). Although personally identifiable information is not made public (Government of the Republic of Korea, 2020a), quite a lot of information about confirmed cases is floating around on the internet (Zastrow, 2020) and some are trying to connect the dots and identify confirmed cases (Kim & Denyer, 2020). Some people say they are more afraid of the psychological distress and social stigma caused by disclosure of information regarding the person, time, and place they met than the physical suffering from the infection (BBC, 2020). At the same time, according to a survey by Statistics Korea (2020), 78.2% of people think that human rights protection should be put off as a subordinate priority when preventive measures against the pandemic need to be strengthened. There is clearly a disagreement among South Korean people regarding the extent to which privacy may be sacrificed.

Such a circumstance can be explained from the perspective of risk tolerance, which indicates an individual's willingness to engage in behaviors that have a desirable goal, but achievement of the goal is uncertain and accompanied by the possibility of loss (Kogan & Wallach, 1964). Previous studies have examined risk tolerance concerning an individual’s susceptibility to financial, environmental, and health risks (Csicsaky, 2001; Grable, 2008; MacCrimmon & Wehrung, 1986; Slovic, 2004). Disclosure of movement of confirmed cases also has a desirable goal of protecting the public's health, but it is not guaranteed to achieve the goal and may involve personal privacy invasions (Joo & Shin, 2020; Zastrow, 2020). Therefore, this article aims to examine privacy risk tolerance for the disclosure of movement records suggested as a countermeasure for COVID-19 in South Korea. In particular, by analyzing factors influencing privacy risk tolerance, we provide implications for the preparation of better countermeasures for the government to implement.

Theoretical background and hypotheses

Protection motivation theory

Protection motivation theory (PMT) uses a cost-benefit analysis to explain how precautionary measures are initiated or maintained. PMT was developed by Rogers (1975) to explain the effects of fear-inducing messages on behaviors and attitudes toward health. PMT has been applied and verified in several studies, and, in most cases, it has been specifically covered in health-related topics. It has been applied in various ways in health-degrading behaviors such as smoking (Thrul et al., 2013) and drinking (Murgraff et al., 1999), diseases such as cancer (McMath & Prentice-Dunn, 2005), and even in infectious diseases such as influenza A (Kim, 2010) or MERS (Yoo et al., 2016).

According to the original PMT, protection motivation and attitude change are mediated by three cognitive components: appraised severity of the depicted event (i.e., severity), expectancy of exposure to the event (i.e., vulnerability), and belief in the efficacy of the recommended adaptive response in protecting self or others (i.e., coping efficacy; Rogers, 1975). Rogers (1983) developed a revised PMT that added variables of cost, reward, and self-efficacy. Response costs refer to all costs that can be incurred by taking the adaptive coping response, and rewards include both intrinsic rewards (e.g., bodily pleasure) and extrinsic rewards (e.g., social approval) earned by not engaging in the adaptive response. Self-efficacy is an evaluation of whether an individual can perform an adaptive response well.

The focus of PMT is on the cognitive mediating processes, and sources of information trigger two appraisal processes: threat appraisal process and coping appraisal process (Rogers, 1983). Threat appraisal evaluates the adaptive or maladaptive responses, while the coping appraisal process evaluates the ability to cope with the threat (Floyd et al., 2000). In the threat appraisal process, rewards increase the probability of the maladaptive response, whereas severity of the threat and vulnerability to the threat decrease the probability of selecting the maladaptive response (Rogers, 1983). In the coping appraisal process, response efficacy and self-efficacy increase the probability of selecting the adaptive response whereas response costs decrease the probability (Floyd et al., 2000; Rogers, 1983).

Regarding confirmed cases of COVID-19, disclosure of movement records is not performed by individuals but by government agencies. Therefore, the concept of self-efficacy is difficult to apply in this article, but we did include the variables of severity and vulnerability of COVID-19, efficacy of disclosing movement records to prevent the spread of COVID-19, and threats to privacy by disclosing movement record as a response cost. It is difficult to apply the concept of rewards obtained by not engaging in the adaptive response because individuals cannot refuse to disclose movement records. Instead, response benefits that could be gained from the disclosure of movement records were included in the coping appraisal process. In a pandemic, the health of individuals and others is strongly interwoven due to contagiousness (Giritli Nygren & Olofsson, 2020), so the benefit variable was defined as a personal or social benefit from sharing movement records.

According to the PMT, we hypothesized that threat severity (H1) and threat vulnerability (H2) would have a positive effect on privacy risk tolerance. In the coping appraisal process, response efficacy (H3) and response benefits (H5) were predicted to have a positive effect on privacy risk tolerance, while response costs (H4) were predicted to have a negative impact.

Institutional trust and social consensus

When it comes to preventing the spread of COVID-19, responses and outcomes at the social level are expected to be derived. In this context, we considered social-level variables—institutional trust and social consensus—which we term the collective appraisal in this study.

Institutional trust can be defined as the confidence with which citizens assess how institutions will perform a particular action in a determined context, independent of whether they can monitor the action or not (Gambetta, 2000). Institutional trust allows individuals to follow the actions of the institution or people associated with it (Lahno, 2002). Without institutional trust, citizens may not voluntarily comply with government demands and regulations (Nye & Zelikow, 1997; Smith, 2010). In a setting in which people trust government or people in general, tolerance is expected to emerge (Berggren & Nilsson, 2014). Therefore, we hypothesized that institutional trust would have a positive impact on personal privacy risk tolerance (H6).

Social consensus refers to the degree to which a social agreement is obtained that a potential issue, which is sharing movement records of those who were positive for COVID-19, is good (Jones, 1991). We hypothesized that social consensus would have a positive impact on the privacy risk tolerance of individuals (H7). The overall research model is described in Figure 1 .

Figure 1

Research model

Methodology

To examine the research model, an online survey was conducted throughout South Korea by a professional online survey agency, Macromill Embrain. The survey target was selected through the stratified sampling method based on the proportion of age, gender, and residential area groups in South Korea. The final analysis included a total of 500 survey responses consisting of 255 males (51%) and 245 females (49%) ranging in age from 20–69.

Measurement items were derived from relevant previous literatures with slight modifications to fit the context of the research. All items were measured by a 7-point Likert scale, ranging from “1 = strongly disagree” to “7 = strongly agree.” The measurement items related to threat severity and threat vulnerability were mainly adopted from Ifinedo (2012) and Park and Woo (2013). The measurement items for response efficacy, response costs, and response benefits were derived from Ifinedo (2012), Yan et al. (2014), and Vance et al. (2012). For institutional trust, measurement items used by Ervasti et al. (2019) and Turow and Hennessy (2007) were considered. The questionnaires about privacy risk tolerance were adopted from Bannier and Neubert (2016). Reliabilities, zero-order correlations, means, and standard deviations of the variables are reported in Table 1 .

Table 1

Reliabilities, correlations, means, and standard deviations

	PRT	TS	TV	RE	RC	RB	SC	IT
PRT	1
TS	.15∗∗	1
TV	.10∗	.65∗∗	1
RE	.61∗∗	.40∗∗	.26∗∗	1
RC	−.48∗∗	−.05	.07	−.31∗∗	1
RB	.63∗∗	.30∗∗	.26∗∗	.73∗∗	−.30∗∗	1
SC	.71∗∗	.32∗∗	.24∗∗	.82∗∗	−.39∗∗	.78∗∗	1
IT	.48∗∗	.11∗	.11∗	.40∗∗	−.13∗∗	.46∗∗	.42∗∗	1
Cronbach’s α	.88	.82	.82	.93	.83	.91	.96	.92
M	5.05	6.12	6.05	6.00	4.85	5.47	5.72	5.24
SD	1.35	0.79	0.79	0.99	1.38	1.16	1.20	1.34

Note: PRT = privacy risk tolerance; TS = threat severity; TV = threat vulnerability; RE = response efficacy; RC = response costs; RB = response benefits; IT = institutional trust; SC = social consensus. PRT, TV, RC, and SC were assessed with three items. TS, RE, RR, and IT were assessed with four items.

∗p < 0.05.

∗∗ p < 0.01.

To examine the research model, regression analysis was conducted using SPSS 19. Before conducting the analysis, gender was dummy-coded, with males being 0 as the reference group and females being 1 as the comparison group. Continuous independent variables were mean-centered to protect against multicollinearity (Cohen et al., 2003). Using hierarchical regression analysis, gender and age as demographic variables are frequently reported to affect information privacy concerns in the previous literatures (Paine et al., 2007; Sheehan, 1999; Smith et al., 2011), and the degree of information searching that can increase involvement in the COVID-19 issue were included as control variables in the first block to reduce the possibility of spurious relationships. Variables related to threat appraisal (threat severity and vulnerability), coping appraisal (response efficacy, costs, and benefits), and collective appraisal (institutional trust and social consensus) were put into the second block.

Results

Our hypothesis predicted that threat severity, threat vulnerability, response efficacy, response costs, response benefits, institutional trust, and social consensus would be predictors of privacy risk tolerance related to the disclosure of movement records of those who were positive for COVID-19.

Table 2 indicates the results of multiple regression analysis. The overall model was significant, F(10, 489) = 77.04, p < .001, adjusted R 2 = .60. When gender, age, and the extent to which one searches for information related to COVID-19 were entered into the regression equation in the first block as control variables, age (β = .13, t = 3.01, p = .003) and information searching (β = .14, t = 3.17, p = .002) were statistically significant. Among predictors in the second block, response costs (β = -.24, t = -7.79, p < .001), response benefits (β = .11, t = 2.34, p = .020), social consensus (β = .42, t = 7.30, p < .001), and institutional trust (β = .20, t = 6.20, p < .001) were statistically significant predictors of privacy risk tolerance, while threat severity (β = -.07, t = -1.75, p = .081), threat vulnerability (β = .00, t = 0.07, p = .944), and response efficacy (β = .05, t = 0.97, p = .332) were not.

Table 2

Multiple regression analysis for privacy risk tolerance

	B	SE	β	t	sr
First block
Gender	−.02	.12	−.01	−0.13	−.01
Age	.13	.04	.13	3.01∗∗	.13
IS	.17	.05	.14	3.17∗∗	.14
F(3, 496) = 6.113, p < .001, R2 = .036, adjusted R2 = .030
Second block
Gender	−.02	.08	−.01	−0.26	−.01
Age	.03	.03	.03	1.11	.03
IS	.01	.04	.01	0.18	.01
TS	−.12	.07	−.07	−1.75	−.05
TV	.00	.07	.00	0.07	.00
RE	.07	.07	.05	0.97	.03
RC	−.24	.03	−.24	−7.79∗∗∗	−.22
RB	.13	.06	.11	2.34∗	.07
SC	.47	.06	.42	7.30∗∗∗	.21
IT	.21	.03	.20	6.20∗∗∗	.17
Fchange(7, 489) = 103.64, p < .001, R2change = .58
The overall model: F(10, 489) = 77.04, p < .001, adjusted R2 = .604

Note: sr = semipartial correlation; IS = information searching for Covid-19. The rest of the abbreviations are the same as in Table 1. Regarding multicollinearity, the predictors had variance inflation factor (VIF) ranging from 1.00 to 4.15, which is lower than 10 as the traditional rule of thumb threshold value (Cohen et al., 2003).

∗p < 0.05.

∗∗ p < 0.01.

∗∗∗ p < 0.001.

While H4 (response costs), H5 (response benefits), H6 (institutional trust), and H7 (social consensus) were accepted, H1 (threat severity), H2 (threat vulnerability), and H3 (response efficacy) were rejected. Unlike most previous studies that have shown that the severity and vulnerability of the threat and efficacy of the response facilitated adaptive intentions or behaviors (Floyd et al., 2000), they did not significantly decrease privacy risk tolerance. The result could be explained by the mean score and standard deviation of the severity and vulnerability of COVID-19 and the efficacy of disclosing movement records. As can be seen in Table 1, only these three variables have a mean score of more than 6, and their standard deviation is also less than 1. Most respondents were aware of the dangers of COVID-19 and agreed on the effectiveness of countermeasures.

Discussion and conclusion

This article aimed to examine factors influencing privacy risk tolerance for the disclosure of movement records suggested as a countermeasure for COVID-19 in South Korea. Unlike existing literature in this article, since the majority of the public recognized the specificity and significance of COVID-19 and the effectiveness of disclosing movement records as countermeasures, it was found that threat severity, vulnerability, and response efficacy did not affect privacy risk tolerance significantly. On the other hand, response costs and benefits were found to be significant predictors. In addition, institutional trust and social consensus—variables devised for collective appraisal in this article—were found to have a positive effect on privacy risk tolerance.

In the face of the global threat of COVID-19, countries around the world are taking various actions to prevent the spread. South Korea is often mentioned as an exemplary case of controlling the spread of the virus by disclosing the movement records of confirmed cases. However, there are scant academic studies in response to privacy concerns caused by the disclosure of information. In addition, because guidelines on information disclosure have been continuously changed even in South Korea, it is necessary to investigate the privacy risk tolerance for movement record disclosure and to establish a clear agreement on the degree of disclosure. Since other countries are showing great interest in South Korea's best practices, this study is expected to provide very timely and important implications.

Another contribution of this research is the examination of collective appraisal in the PMT framework. Institutional trust and social consensus had a strong positive impact on privacy risk tolerance. This finding is particularly important as the influence of institutional trust and social consensus was relatively greater than that of other variables in this study, although the collective appraisal process was not considered in the existing research on protection motivation theory. In a pandemic, the information accessible to individuals may be insufficient or inaccurate (Kim & Kreps, 2020), so the government plays a critical role in effective crisis management and control (Ou et al., 2014). Also, because infectious diseases are highly contagious, it is a problem that cannot be solved by being careful alone; all members of our society must work together (WHO, 2020). Accordingly, we show that a collective appraisal process was necessary to evaluate the privacy risk tolerance related to the disclosure of movement records of confirmed cases as a measure to prevent the spread of infectious diseases. Accordingly, our findings suggest that a collective appraisal process needs to be included in the PMT when the threat is social or a collective effort is required to respond. It is significant that the scope of theoretical discussion can be expanded by including the collective appraisal process in the PMT.