"I need to know I'm safe and protected and will check": users want cues to signal data custodians' trustworthiness

Privacy-related decisions are complex and nuanced, and consume extensive cognitive resources. Yet, people make these kinds of decisions many times a day. This means that they might not be able to invest significant cognitive resources in making each and every decision. We tested the extent to which the statements displayed to the users with the purpose of assuring them that their security and privacy is protected would resonate with people when they were considering whether or not to divulge their personal health information to an online service. We carried out two empirical investigations: (1) we used scenarios of health data being transmitted securely to a health provider, and asked participants to tell us what would convince them to divulge their personal information. (2) We then used these statements in a Q-sort to gauge subjective opinions of the persuasiveness of the statements, and to reveal 'ways of thinking' engaged in by our participants in this respect. We discovered that our participants wanted to see evidence that the organisation was implementing required security measures. Thus, our study suggests, despite a common assumption, that people do care, and that they want reassurance that companies are trustworthy custodians of their health data.