Privacy management in service systems

Problem definition: We study customer-centric privacy management in service systems and explore the consequences of extended control over personal information by customers in such systems.Methodology: We adopt a stylized queueing model to capture a service environment that features a service provider and customers who are strategic in deciding whether to disclose personal information to the service provider---that is, customers' privacy or information disclosure strategy. A customer's service request can be one of two types, which affects service time but is unknown when customers commit to a privacy strategy. The service provider can discriminate among customers, based on their disclosed information, by offering different priorities.Results: Our analysis reveals that, when given control over their personal data, strategic customers do not always choose to withhold it. We find that control over information gives customers a tool they can use to hedge against the service provider's will, which might not be aligned with the interests of customers. More importantly, we find that under certain conditions, giving customers full control over information (e.g., by introducing a privacy regulation) can not only distort already efficiently operating service system but might also backfire by leading to inferior system performance (i.e., longer average wait time) and hurt customers themselves. We demonstrate how a regulator can correct information disclosure inefficiencies through monetary incentives to customers and show that providing such incentives makes economic sense in some scenarios. Finally, the service provider itself can benefit from customers being in control of their personal information by enticing more customers joining the service.Managerial implications: Our findings yield insights into how customers' individually rational actions concerning information disclosure (e.g., granted by a privacy regulation) can lead to market inefficiencies in the form of longer wait times for services. We provide actionable prescriptions, for both service providers and regulators, that can guide their choices of a privacy and information management approach based on giving customers the option of controlling their personal information