Toward a taxonomy of corporate data protection malpractices and their causal mechanisms: A regulatory view

Authors

Haiping Zhao, Department of Information Management, School of Economics and Management, China University of Petroleum, Qingdao, China
Na Jiang, Department of Management, Faculty of Business and Management, BNU-HKBU United International College, Zhuhai, China
Zhao Cai, Department of Entrepreneurship, Marketing and Management Systems, Nottingham University Business School China, University of Nottingham Ningbo China, Ningbo, China
Eric T.K. Lim, School of Information Systems and Technology Management, UNSW Business School, UNSW Sydney, Sydney, Australia
Chee-Wee Tan, Department of Digitalization, Copenhagen Business School, Copenhagen, Denmark

Document Type

Research Article

Abstract

Corporate data protection malpractices are not uncommon, especially in contemporary technological environments. Embracing a regulatory view, this study attempts to advance a taxonomy of prevailing corporate data protection practices and their causal mechanisms by analyzing cases where organizations were fined for violating data protection legislation. Selecting the General Data Protection Regulation (GDPR) enacted by the European Union (EU) as our benchmark, this study employs an iterative taxonomy development technique as guidance and conducts a thematic analysis on 875 cases of GDPR enforcement. In so doing, we derive a conceptual model comprising 6 focal categories and 28 subcategories of prevailing corporate data protection malpractices existing within organizations as well as 4 main categories and 22 subcategories of causal mechanisms underlying these identified malpractices. Empirical findings from this study not only reinforce corporate data protection malpractices established in prior research but also yield novel malpractices that have been neglected in previous work. From a pragmatic standpoint, this study yields invaluable insights into the prevention and resolution of corporate data protection malpractices for practitioners.

DOI

10.1177/02683962231155937

Recommended Citation

Zhao, Haiping; Jiang, Na; Cai, Zhao; Lim, Eric T.K.; and Tan, Chee-Wee (2023) "Toward a taxonomy of corporate data protection malpractices and their causal mechanisms: A regulatory view," Journal of Information Technology: Vol. 38: Iss. 3, Article 5.
DOI: 10.1177/02683962231155937
Available at: https://aisel.aisnet.org/jit/vol38/iss3/5