Privacy Management in Service Systems

We study customer-centric privacy management in service systems and explore the consequences of extended control over personal information by customers in such systems. Our stylized model of a service environment features a service provider and customers who are strategic in deciding whether to disclose personal information to the service provider – that is, customers' privacy or information disclosure strategy. A customer's service request can be one of two types, which affects service time but is unknown when customers commit to a privacy strategy. The service provider can discriminate among customers, based on their disclosed information, by offering different priorities. Our analysis yields three sets of main insights. First, when given control over their personal data, strategic customers do not always choose to withhold it. We find that control over information gives customers a tool they can use to hedge against the service provider's incentives, which might not be aligned with the interests of customers. Second, a customer's self-centered strategic decision may or may not be aligned with what is best for customers themselves. In fact, giving customers full control over information might backfire by leading to inferior system performance (i.e., longer average wait time) and hurting customers themselves. We demonstrate how a regulator can correct information disclosure inefficiencies through monetary incentives to customers and show that providing such incentives makes economic sense in some scenarios. Finally, the service provider itself can benefit from customers being in control of their personal information by enticing more customers joining the service. Our findings shed light on the market for pricing personal information in the service industry.