ONLINE PRIVACY AND SECURITY AT THE FORTUNE 500: AN EMPIRICAL EXAMINATION OF PRACTICES

Fair Information Practices (FIP) principles have been recognized by U.S. government agencies since 1974 in an effort to provide stakeholders with a measure of protection. However, the recent proliferation of online data breaches calls to question the policies and practices of the businesses responsible for protection of the constituent data. This study was undertaken to expand upon previous studies and investigate the usage and composition of privacy policies and, in particular, the security aspects of these policies. Results illustrates that nearly all Fortune 500 firms post their privacy policy online and the number of firms utilizing third-party compliance logos is increasing. Moreover, security techniques, data collection techniques, child data policies, and mobile application policies are now more commonly included and described in privacy policies. The usage of the FIP practices of notice/awareness, choice/consent, access/participation, and security/integrity, however, does vary and is changing.