How to Optimize Your Company’s Approach to Data Privacy

Firms are increasingly investing in how they protect consumer data and give consumers more control of their data, but this type of data privacy performance requires a delicate balance. The higher the performance of a firm on data privacy, the more it might be giving away opportunities to monetize the data it has collected. The lower the performance of a firm on data privacy, the more susceptible the firm is to risk from multiple harms (e.g., reputation scandals, litigation penalties). When it comes to data privacy, firms lose out if they tip too far in one direction of the other. So, what should leaders do?

To answer this question we examined how financial markets evaluate firms’ data privacy performance. Information about data privacy was drawn from TruValue Labs, a company that leverages natural language processing to analyze over 100,000 sources of unstructured data about firms’ Environmental, Social, and Governance (ESG) performance. TruValue Labs defines a firm’s data privacy performance drawing on the SASB measurement system. We complemented TruValue data with firm’s financial data compiled by COMPUSTAT. We measured firm’s market valuation using the ratio of market value of assets over the book value of the assets. Higher values imply better competitive position, and higher future growth potential.

We found that the relationship between data privacy performance and firm’s market valuation is more complicated than the conventional wisdom of “the more the better” suggests. Instead, the relationship takes the form of an inverted U-shape; the higher firms perform on data privacy, the more they are valued by financial markets, but only up to an optimal turning point, above which improving performance actually hurts firms’ market valuation.

The Competing Views Behind This Complex Relationship

In general, an inverted U-shaped relationship between two attributes suggests that two countervailing forces (or competing views) are in play. On the one hand, given the consumer-privacy paradox — according to which consumers claim that they care about privacy, although their actual behavior shows that they don’t — outperforming most other companies (i.e., the “crowd”) on data privacy, might be interpreted by financial markets as managerial malpractice. For example, one recent study has shown that shoppers, with other conditions remaining the same, equally patronize a store that requests more personal information relative to an identical store that does not. According to this view, implementing a stringent data privacy policy places unnecessary constraints on firms’ capabilities to innovate and capitalize on digital technology, thereby leading to reduced profitability, and perhaps less benefits to consumers. Consider Netflix, for example. How would financial markets interpret a decision to cut down on the amount of consumer data the company is collecting to deliver its customized viewing experience?

On the other hand, the ever-growing collection and use of personal data — with consumers not knowing what, when, and who collected their personal data — increases their perception of vulnerability and potential for harm. In response, a pro-privacy social movement is on the rise, urging people to stop giving away their valuable data for free, and pressuring firms to do more, beyond merely complying with regulations. By swaying public opinion, the pro-privacy social movement can inflict reputational damages to firms. Consider, for example, the Open Markets Institute — an organization close to policymakers and the House of Representatives’ antitrust subcommittee — and its recent call for taking action against firms eroding data privacy. Again, ignoring such public opinion pressures and the so-called “privacy actives” implies an important risk to firms.

Interestingly, the majority of U.S.-based, publicly traded firms are earning — in our research — an optimal data privacy performance score, indicating that they are successfully balancing consumers’ privacy demands and shareholder’s financial demands. We don’t conclude that this means that they are necessarily making good decisions about data, but instead that they are making similar decisions. As a result, companies that deviate from the norm are punished by either consumers or shareholders. Put another way, firms with a data privacy performance score close to what other firms’ enjoy a higher market valuation (ceteris paribus), compared to firms that deviate from the crowd, and are thereby following a suboptimal strategy.

The caveat here is that the optimal data privacy performance score depends on which of the two competing views prevails at a certain point in time. Stated differently, the optimal score — or where the “crowd” is — is not stationary, but dynamic. Leaders must therefore be alert and adapt their firm’s data privacy performance by continuously monitoring the dominance of each competing view in a society.

What Should Leaders Do To Navigate this Complexity?

Our research shows that the winners are clearly firms that lay low and follow the crowd. Underperforming on data privacy is not a good strategy to follow; financial markets will discount explicit (e.g., litigations, sales losses) and implicit (e.g. reputation depletion) costs, due to the increased probability of consumers’ personal data embezzlement. At the same time, outperforming on data privacy is also not a good strategy, as financial markets will discount a firm’s expected rewards due to stifled innovation and unrealized growth.

Instead, our analysis shows that financial markets positively evaluate firms that are employing what organizational theorists call “mimetic isomorphism,” or what we call “following the crowd” strategy. In other words, financial markets believe that when a course of action is unclear (as is the case with data privacy performance), the safest way is being isomorphic with what others do. Accordingly, we urge leaders to benchmark their data privacy performance against how the “crowd” performs, and be alerted for any deviations.