Organizational privacy climate influences software developers privacy practices
From Regulation to Engineering: Organizational Privacy Climate as Mediator
Computers and SocietyHuman-Computer InteractionSoftware Engineering
Summary
Privacy laws like the GDPR set rules on how personal data should be handled, but turning those rules into actual software practice isn’t simple. The authors surveyed U.S. software developers and found that the way an organization treats privacy (its privacy climate) affects how seriously developers take privacy rules. This attitude then influences how they build privacy into their software. The study shows that privacy laws work through organizations and individual attitudes before impacting engineering work.
What this means in practice
- •For software development teams: Design organizational policies that strengthen the privacy climate to improve developers’ incorporation of privacy into software.
- •For privacy compliance officers: Use insights on organizational climate’s mediation to better guide teams in aligning engineering practices with privacy regulation.
Authors
Oshrat Ayalon, Eran Toch, Irit Hadar, Michael Birnhack
Abstract
Data protection legislation aims to protect privacy rights by regulating how information systems store and process personal information. While such legislation defines legal obligations, translating regulatory requirements into engineering practice is far from straightforward. As new frameworks such as the EU AI Act emerge, understanding these mechanisms becomes increasingly relevant. To investigate them, we conducted an online survey of 156 U.S. information system developers, examining the role of organizational privacy climate in the association between developers' perceptions of the GDPR and their privacy engineering practices. Using structural equation modeling, we found that organizational privacy climate mediates the relation between developers' perceived GDPR importance and their privacy attitudes, which in turn are associated with their privacy engineering practices. The mediation chain - regulation, climate, attitudes, practices - complements the direct effect of regulation on practice, revealing the organizational and attitudinal pathway through which regulatory intent reaches engineering behavior. We discuss implications for the next generation of privacy and AI regulation.