Does Imperfect Data Privacy Stop People from Collecting Personal Data?

Abstract

Many companies try to access personal information to discriminate among consumers. We analyse how privacy regulations affect the acquisition and disclosure of information in a simple game of persuasion. Theory predicts that no data will be acquired with Disclosure Duty of collected data whereas Consent Law with perfect privacy results in complete information acquisition. Imperfect privacy, i.e., an environment in which leaks of collected data are possible, gives rise to multiple equilibria. Results from a laboratory experiment confirm the qualitative differences between Consent Law and Disclosure Duty and show that imperfect privacy does not stop people from collecting personal information.

1. Introduction

In modern economies information is key. People collect data every minute and share it frequently with third parties. People collect data on their GPS location through their smartphones or use wearables to keep track of their personal health status. Such information is on the one hand valuable to the individual and, on the other hand, valuable to companies. So far, the behavioural literature on preferences for privacy has mainly focused on information transmission, i.e., on when and why people share their personal data (see for instance [1,2,3,4,5,6,7]). This research has informed policy makers from which privacy regulations individuals may benefit or suffer. In this paper we argue that it not only important to understand under which conditions people are willing to share personal data but, even more so, to investigate how privacy regulations affect the willingness to acquire such information in the first place, as this may have severe consequences for individuals as well as aggregate market outcomes and welfare (see also [8]).

Studying how privacy regulations affect the acquisition of personal information can inform policy makers under which conditions information asymmetries arise and is of great importance to judge institutional consequences for rent distributions and welfare. One particularly important example for an environment with asymmetric information are health markets. On the one hand, keeping track of one’s personal health status by using wearables, visiting the doctor regularly or undertaking specific medical tests (e.g., tests for chronic diseases, sexually transferable diseases (STDs) or genetic tests) benefits the individual. It offers possibilities of prevention and early interventions of serious diseases, and may as well benefit the individual through preferable rates for insurance. On the other hand, these documentations and tests generate data that are valuable for insurers. Insurers can benefit from access to such data, as it is in insurers’ interest to discriminate among different health types.1 However, anticipating such discrimination, patients may become reluctant to collect personal health data or forego specific medical tests and thereby also potential benefits from information acquisition.2

Across the world, different data privacy regulations have been proposed and implemented. Some of them explicitly involve a risk of discrimination when acquiring personal data. For instance, Disclosure Duty, a regulatory rule used for genetic testing in New Zealand, the UK and Germany (see [11]) creates such a risk, as under Disclosure Duty patients have to disclose collected information when contracting with an insurer. Other institutions, such as Consent Law3 (implemented for genetic testing e.g., in the Netherlands and Switzerland, [10]) aim at leaving patients in full control of their collected data and let patients themselves decide whether or not to disclose them.4

There exist several studies that have theoretically discussed the welfare implications of different regulatory institutions in the context of insurance markets (see e.g., [11,13,14,15,16]) and matching markets (see e.g., [17,18]).5 However, causal empirical evidence on the consequences of privacy institutions for information acquisition is missing. Further, the theoretical literature has so far neglected a central aspect concerning privacy regulations: Perfect privacy—as assumed under Consent Law—cannot always be guaranteed; in particular not for centrally collected health data.6

Imperfect Privacy may result for at least two reasons. First, information about personal health attributes has often to be generated through the help of third parties (e.g., doctors and laboratories conducting medical tests, wearables and smartphone apps etc.) and thus patients are not in full control of their personal data. Second, recent incidents of leakage and data breaches, e.g., in 2007, where hundreds of thousands of UK National Health Service patients’ details were lost (see [24]), have remembered the public that perfect control over personal data cannot be taken for granted. Further, technological advances have increased the possibilities of health and genetic testing such that more and more data can be collected, stored and accessed.

The aim of this article is twofold. First, we extend the theoretical discussion about the consequences of Perfect Privacy and Disclosure Duty for testing and disclosing information (see also [25]) by asking how people’s behaviour should change when Perfect Privacy cannot be guaranteed due to a positive probability of involuntary data transfer (e.g., data leakage).7 Second, we enrich the so far theoretical discussion of privacy regulations by providing experimental evidence on the relation of privacy institutions, information acquisition and information disclosure. We provide a novel and parsimonious laboratory experiment that allows for the identification of causal effects of three different privacy institutions (Disclosure Duty, Consent Law with Perfect Privacy and Imperfect Privacy, i.e., a Consent Law environment where patients are not in full control of their collected data).8 The experiment is closely linked to our simple model and provides additional guidance on behaviour for institutional environments with multiple equilibria.

Both, our theoretical framework and our experiment build on a simplified game of persuasion that captures the main incentive structures people face in the context of acquisition and disclosure of personal health data. In the main model, we focus on the individual benefits from testing for insurance premiums.9 Patients decide whether to collect information about their own health status—which can be good or bad. Thereafter they decide whether or not to disclose the collected information to persuade an insurer to offer a contract. The information transferred affects the prospects for a contract with the insurer, because the insurer’s profits depend on the patient’s health status. The insurer will contract with an identified good health type but will refuse to contract with an identified bad type.10 Because the insurer cannot directly identify whether a test has been conducted, it depends on the institutional setting whether or not the insurer will contract with an unknown type.

We focus on the decision to take tests which reveal information that is valuable to the insurer, e.g., information about people’s unchangeable health attributes (such as results from tests for chronic diseases or genetic tests). In contrast to more complex models (see e.g., [11,15,16]), we do not explicitly focus on genetic testing as an informative action for the patient in our simple game. Instead, we follow the approach for STD testing and protection by Philipson and Posner [18] (which abstains from modelling benefits from testing explicitly) but extend our theoretical analysis by providing a discussion on the robustness of our results with respect to explicit costs and benefits from testing.

Mirroring the logic of propositions 1 and 2 in the model Matthews and Postlewaite [25], we show that given insurers are ex ante willing to contract with unknown health types, the only Proper Equilibrium [26] for Disclosure Duty is a pooling equilibrium in pure strategies, in which patients will not collect information. The only Proper Equilibrium for Perfect Privacy is a separating equilibrium in pure strategies with full information acquisition. For Imperfect Privacy, we show that there exist, both, the separating equilibrium with complete information acquisition and the pooling equilibrium without information acquisition (as well as a proper mixed strategy equilibrium with incomplete information acquisition).11

Due to the existence of multiple equilibria under Imperfect Privacy our theoretical model does not provide clear guidance with respect to whether imperfect data privacy stops people from collecting personal information. Further, behavioural biases may affect whether or not people acquire and disclose information on their type. Therefore, we investigate which outcomes result from actual behaviour in a laboratory experiment. Participants of the laboratory experiment played a neutrally framed version of the simple persuasion game. We parameterize the game such that insurers were ex ante willing to contract with unknown health types and implemented three different treatments reflecting the privacy institutions described above. The experimental results show that behaviour in Perfect Privacy and Imperfect Privacy almost coincides. Thus, imperfect data privacy does not stop people from collecting personal information. Only under Disclosure Duty information acquisition is reduced (and contracting with unknown types becomes common).

2. Theory

2.1. The Model

Our theory builds on a simple game of persuasion which reflects the idea of an insurance market in which a patient (player 1) persuades an insurer (player 2) to contract by providing certified information about her health type. Player 2 can contract (from now on match) with player 1 and both may benefit from the match. A match is always profitable for player 1. However, player 2’s payoff depends on player 1’s type. Player 1 can be a good (type G) or a bad type (type B). A match with a good type increases player 2’s payoff. A match with a bad type decreases his payoff (e.g., costs for medical treatments to be paid by the insurer). A match results in payoff M for each player. However, if player 1 is a bad type, player 2 additionally incurs a loss of I.12 We assume M > 0, I > 0, and I > M. The last assumption describes the fact that a match with a bad type decreases player 2’s payoff. Let 0 < b < 1 be the share of bad types in the population of players 1. Further, for the main model, we assume both players to be risk neutral.13

Importantly, player 1 does not know her type ex-ante, but she can test and disclose her type to player 2 before player 2 decides on whether to match. Testing and disclosing is costless.14 The action of testing (not testing) is denoted by $T\left(\overline{T}\right)$. Results from such tests reveal relevant information as soon as they have been taken (irrespective of whether the test is taken several times) such that the decision to test reflects a one-shot decision of an inexperienced actor. The action of voluntarily disclosing (not voluntarily disclosing) the test result to player 2 is denoted by $D\left(\overline{D}\right)$. Let $d_G,d_B$ be the probabilities that type G and type B voluntarily disclose their type after testing.

Player 2 can learn player 1’s type only if player 1 had herself tested. After a test, player 1 might disclose her type voluntarily. However, player 2 might learn the test result although player 1 decided against disclosing with probability $p$. Therefore, $p=1$ reflects Disclosure Duty, $p=0$ reflects Perfect Privacy and $0<p<1$ reflects Imperfect Privacy. Note that the action of testing itself cannot be observed. Hence for p < 1, if player 2 does not learn player 1’s type, he also does not learn whether player 1 had herself tested or not. Let U (unknown) denote the fact that player 2 does not know player 1’s type. $X\left(\overline{X}\right)$ denotes player 2’s decision to match (not to match) and s_i denotes the strategy of player i. All decisions are binary.

We are now ready to describe the existence of equilibria under the different privacy institutions. For all institutions, player 2 will match with an identified type G and will never match with an identified type B. Whether player 2 will match with an unidentified type U, depends on the data privacy institution (i.e., on $p$) as well as on the relative size of gains from a match ($I$) and expected losses ($bI$). In the following, we present equilibria in pure strategies for each institution separately followed by a short intuitive reasoning.15

Proposition 1.

(Disclosure Duty)

(a)

For $p=1$ and $M\le bI$

$$\begin{gathered} s_1=T \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=\overline{X} \end{gathered}$$

is a pure strategy equilibrium (complete information acquisition).

(b)

For $p=1$ and $M\ge bI$

$$\begin{gathered} s_1=\overline{T} \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=X \end{gathered}$$

is a pure strategy equilibrium (no information acquisition).

Because all test results are revealed under Disclosure Duty, an unknown type has to be an untested player. The expected payoff of a match with an untested player is non-positive as long as $M\le bI$. Therefore, for $M\le bI$ player 2 will not match with untested players and player 1 can only gain from testing. For $M\ge bI$ the expected payoff of a match with an untested player is non-negative. Therefore, player 2 will match with untested players and player 1 will not test.

Proposition 2.

(Perfect Privacy)

(a)

For $p=0$

$$\begin{gathered} s_1=T,s_1\left(G|T\right)=D,s_1\left(B|T\right)=d_B\mathrm{with}0\le d_B\le 1, \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=\overline{X} \end{gathered}$$

is a pure strategy equilibrium (complete information acquisition).

(b)

For $p=0$ and $M\ge bI$

$$\begin{gathered} s_1=\overline{T},s_1\left(G|T\right)=d_G\mathrm{with}0\le d_G\le 1,s_1\left(B|T\right)=\overline{D}, \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=X \end{gathered}$$

is a pure strategy equilibrium (no information acquisition).

If player 2 does not match with unknown types, it is worthwhile to test for player 1. Also, it will be worthwhile for player 1 to disclose her test result if the test reveals that she is of type G. Type B is indifferent whether or not to disclose her type. In turn, as everybody tests and type G discloses her type, player 2 will not match with unknown types (who are all of type B).

Given player 2 matches with type G and unknown types U, player 1 is (in expectation) not better of when testing and hence does not deviate from her strategy of not testing.

Proposition 3.

(Imperfect Privacy)

(a)

For $0<p<1$

$$\begin{gathered} s_1=T,s_1\left(G|T\right)=D,s_1\left(B|T\right)=d_B\mathrm{with}0\le d_B\le 1, \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=\overline{X} \end{gathered}$$

is a pure strategy equilibrium (complete information acquisition).

(b)

For $0<p<1$ and $M\ge bI$

$$\begin{gathered} s_1=\overline{T},s_1\left(G|T\right)=d_G\mathrm{with}0\le d_G\le 1,s_1\left(B|T\right)=\overline{D}, \\ {s}_2\left(G\right)=X,s_2\left(B\right)=\overline{X}\mathrm{and}{s}_2\left(U\right)=X \end{gathered}$$

is a pure strategy equilibrium (no information acquisition).

The intuition for the equilibrium with complete information acquisition (3a) is the same as for (2a). The intuition for the equilibrium with no information acquisition (3b) is that given player 2 matches with type G and unknown types U, it is clearly worthwhile to forgo collecting information as long as data privacy is not guaranteed ($p$ > 0) because not collecting information prevents involuntary disclosure of being a bad type. If nobody tests, the set of untested players and the set of players of unknown types coincide. Thus, matching with unknown types will be worthwhile (or at least not harmful) for player 2 for $M\ge bI$.

In addition to the pure strategy equilibria there exist several mixed strategy equilibria in which information acquisition is incomplete. We relegate the derivation of these equilibria to Appendix B (but report the existence of these equilibria along with refined pure strategy equilibria in Figure 1).

2.2. Robustness: Risk Aversion, Costs and Benefits from Testing and Equilibrium Refinements

2.2.1. Risk Aversion

Let us briefly discuss the robustness of the different equilibria with respect to our assumption of risk neutral players. For all institutions, equilibria without information acquisition and incomplete information acquisition do not exists if player 2 (the insurer) is sufficiently risk averse because in this case player 2 will only match with identified good types. The equilibrium with full information acquisition holds also for risk averse players, since player 2 chooses the save option (matching with tested good types only) in equilibrium and player 1 has, in equilibrium, nothing to lose by playing the “lottery of testing.”16

2.2.2. Costs and Benefits from Testing

We abstained from modelling costs and benefits from testing explicitly. In this section, we briefly discuss how the introduction of costs and benefits affects the existence of the different equilibria. We will consider both, costs and benefits from testing that do not depend on the outcome of the test (costs of the test) and costs that depend on the testing outcome (psychological costs).17

First, it is clear that pure strategy equilibria in which people decide to test and reveal will still exist, if we introduce benefits from testing (both outcome dependent and outcome independent benefits), because benefits make testing even more attractive. Second and analogously, pure strategy equilibria without information acquisition and matching with unknown types will still exist, if we introduce costs from testing (for both types of costs). Third, it can be shown that the equilibria with full information acquisition also hold with explicit costs from testing as long as the expected gains from testing outweigh the costs. Equilibria with no information acquisition still hold for $p>0$ as long as the benefits from testing for Player 1 are smaller or equal to the expected loss of a match due to the revelation of a bad test outcome. However, under Perfect Privacy ($p=0$), the equilibrium without information acquisition does not hold as soon as there are benefits from testing. Player 1 will test because collecting benefits from testing is riskless, if privacy is guaranteed.

2.2.3. Equilibrium Refinements

We derived multiple equilibria for each institutional setting. In this subsection we briefly discuss whether the number of equilibria may be reduced by applying the equilibrium refinement concept of Proper Equilibrium [26]. The notion of Proper Equilibrium has been introduced by Myerson [26] and is a further refinement of Selten’s [27] Trembling-Hand Perfect Equilibrium. Proper Equilibria consider the possibility that players play also non-equilibrium strategies with positive but very small probability such that decision errors are possible. The main idea of the Proper Equilibrium concept is that the likelihood of an error depends on the costs of making the error, i.e., making a costlier error can never be more likely than making a less costly error.

Applying this idea to our propositions it can be shown that for Perfect Privacy ($p=0$) the equilibrium without and incomplete information acquisition are no Proper Equilibria.

All equilibria we derived for Imperfect Privacy and Disclosure Duty remain. Figure 1 summarizes these findings. The figure illustrates that privacy institutions do not matter for testing if M < bI. Here only equilibria with complete information acquisition are possible. Since M = bI is a very unlikely assumption, we focus on the most interesting case (M > bI) where matches are ex-ante profitable for all agents in expected terms. Here, were find a unique Proper Equilibrium with no information acquisition in Disclosure Duty, and a unique Proper Equilibrium with complete information acquisition in Perfect Privacy. However, there exist multiple Proper Equilibria for Imperfect Privacy (for M > bI). Hence, the model does not provide a clear prediction with respect to the question whether Imperfect Privacy stops people from collecting information. Our experiment allows us to investigate whether behaviour under Imperfect Privacy coincides rather with behaviour under Perfect Privacy or Disclosure Duty.

3. Experiment

3.1. Experimental Design (Parameters and Treatments)

We chose the following parameter values for the experiment which fulfil the condition M > bI: The share of bad types B within players 1 was $b=1/3$. A match M yielded 10 points for both players. A match with type B additionally decreased player 2’s payoff by 15 points (I = 15). At the beginning of the experiment, each player received an endowment of 10 points to prevent negative payoffs. Half of the participants were randomly assigned to the role of player 1 and half to the role of player 2. Then, player 1 and 2 were randomly assigned to a pair. Player 1 decided whether to test for her type and, depending on the treatment, whether to disclose the test result. Testing and disclosure was costless. Player 2 (potentially) learned the test result and decided whether or not to match.

We implemented three values of $p$ as treatment conditions in a between-subjects design: $p=1$ (Disclosure Duty), $p=0$ (Perfect Privacy) and $p=0.5$ (Imperfect Privacy). After as test, the test result was displayed to both players automatically in Disclosure Duty whereas in Perfect Privacy, player 1 first learned the test result and then decided whether to display the result to player 2. In Imperfect Privacy, after a test, player 1 first learned the test result and second decided whether to display the result to player 2. However, if player 1 decided to test she ran the risk of involuntary disclosure of the test result. If a player 1 had decided to test but not to transfer the information to the other player, a random device determined whether the test result was, nevertheless, shown on player 2’s screen.18 Note that player 2 only received information about the type of player 1 but not about whether or not this information was voluntarily revealed. Disclosing test results was costless and the test result displayed to both players was true in all treatments.19 The experiment consisted of two parts.

3.2. Part 1 (One-Shot)

In Part 1, the game was played once. This condition reflects on the one hand the idea that many specific tests (such as genetic tests) are usually not taken repeatedly and frequently taking a test once is sufficient that the information created by the test can be assessed by others (e.g., insurers) and on the other hand, that the decision to buy a specific insurance, e.g., disability insurance, is usually non-repeated. After participants made their decisions they were informed about their profit and player 1’s type.

3.3. Experimental Design for Part 2 (Repeated)

To control for potential decision errors and learning, we added a second part to the experiment, in which participants decided in ten periods whether or not to test (and disclose) or match. To exclude individual reputation building across periods and parts, we used a perfect stranger design (i.e., no participant interacted with the same person more than once and this was common knowledge). In the second part, participants were informed about player 1’s type, and their profit after every round.

3.4. Experimental Procedures

Each player sat at a randomly assigned and separated computer terminal and was given a copy of written instructions.20 At the beginning of the experiment participants were informed that the experiment consists of two independent parts. Participants received the instructions for the second part only after they finished the first part. Participants knew that it would be randomly determined at the end of the experiment which part would be payoff relevant. In case part two was selected, one randomly determined period was payoff relevant. The experiment was neutrally framed, i.e., we did not use the term patient or insurer or expressions such as “good” or “bad” types. Participants acted as player 1 or 2 and player 1 was either of type A or B. A set of control questions was provided to ensure that participants understood the game. If any participant repeatedly failed to answer correctly, the experimenter provided an oral explanation. No form of communication between the players was allowed during the experiment. We conducted ten sessions at the LakeLab (University of Konstanz, Germany) in June 2015 with a total number of 258 participants (N_{Perfect Privacy} = 76, N_{Imperfect Privacy} = 102, N_{Disclosure Duty} = 80). We computerized the experiment using z-Tree [30]. We recruited participants from the local subject pool using the online recruiting tool ORSEE [31]. In all treatments participants decided in one role, either as player 1 and or player 2 and kept that role for the whole experiment. To avoid testing out of general curiosity, players were informed ex ante that they will learn their type ex post (after decisions by both players were made). Further, participants were informed about all decisions and payoffs after every round. Procedures and parameters were common knowledge. Our experiment lasted 1 h. 10 points were equivalent to 6 euros. Participants received a 4 Euro show-up fee and earned 13.60 euros on average ($15.23 at that point in time). Participants also answered a short post-experimental questionnaire on their socio-economic background and their risk attitudes.

3.5. Experimental Results

3.5.1. Testing, Disclosing and Matching (Part 1: One-Shot)

Panel A of Figure 2 presents testing frequencies for all treatments in Part 1. Testing in Perfect Privacy is significantly more likely than in Disclosure Duty (χ²-test, p-value = 0.001). Also, testing in Imperfect Privacy is significantly more likely than in Disclosure Duty (χ²-test, p-value = 0.001). Testing frequencies in Perfect Privacy and Imperfect Privacy do not significantly differ (χ²-test, p-value = 0.631). Hence, only if data loss is certain, a significant share of players stops collecting information. We summarize this finding in Result 1.

Result 1

Testing frequencies in Perfect Privacy and Imperfect Privacy are higher than in Disclosure Duty. Testing frequencies in Perfect Privacy and Imperfect Privacy do not differ.

Panel B of Figure 2 shows that almost all tested good types disclosed their type in Perfect Privacy and Imperfect Privacy,21 whereas voluntary disclosure of bad types is rare.22 Following, almost all players in Perfect Privacy and (almost all players in) Imperfect Privacy who did not disclose their type, are tested bad types or untested players.

Result 2

Disclosure behaviour in Perfect Privacy and Imperfect Privacy does not differ. Good types disclose their type, bad types are highly unlikely to do so.

Given that in Imperfect Privacy and Perfect Privacy players 1 test and good types disclose their type but fewer players test in Disclosure Duty, we should observe fewer matches with unknown types in Imperfect Privacy and Perfect Privacy compared to Disclosure Duty. As Panel C of Figure 2 shows, this is indeed the case: In Disclosure Duty 73 percent of players facing an unknown type decide to match whereas only 31 percent do so in Perfect Privacy (Fisher’s exact test, p-value = 0.001) and in Imperfect Privacy (Fisher’s exact test, p-value = 0.014). However, players 2 behaviour does not coincide with best responses of a risk neutral player given actual testing and disclosure rates (i.e., always matching with an unknown type in Disclosure Duty and never matching with an unknown type in Perfect Privacy and Imperfect Privacy).

However, participants rarely make errors when matching with disclosed types. Out of 65 disclosed good types 63 received a match. All 17 disclosed bad types received no match. We summarize these findings in Result 3.

Result 3

Matching with unknown types is not more likely in Imperfect Privacy than in Perfect Privacy but significantly more likely in Disclosure Duty.

Finally, we analyse whether efficiency varies across the different privacy institutions. As each match generates a surplus, we can measure efficiency by the total frequency of matches. According to our parameters and the Proper equilibria in Figure 1 we should ex ante expect 100% matching in Disclosure Duty and 66.67% matching in Perfect Privacy. In Imperfect Privacy, the matching probability depends on the equilibrium that is selected. In the equilibrium with no information acquisition we should expect 100% matching, in the equilibrium with full information acquisition we should observe 66.67%. The mixed equilibrium strategies result in 68.57% matching for our parameter values. However, since information acquisition and transmission does not significantly differ in the two privacy institutions and people rarely make errors when matching with disclosed types in the behavioural data, differences in efficiency between Imperfect Privacy and Perfect Privacy are expected to be small. If at all we should expect slightly fewer matches (and thus lower efficiency) in Imperfect Privacy, because insurers can identify some tested but undisclosed bad health types in Imperfect Privacy, given data is disclosed involuntarily. As can be seen in Panel D of Figure 2, we find that matching tends to be less likely in Imperfect Privacy compared to Perfect Privacy (57 vs. 68 percent) but does not differ significantly (χ²-test, p-value = 0.267). Disclosure Duty yields the highest level of efficiency, since it results in the most matches but also fails to differ significantly from the other two institutions (Disclosure Duty vs. Imperfect Privacy, χ²-test, p-value = 0.124 and Disclosure Duty vs. Perfect Privacy, χ²-test, p-value = 0.693).

Result 4

Efficiency levels do not significantly differ across treatments.

3.5.2. Testing, Disclosing and Matching (Part 2: Repeated)

Table 1. Random effects probit regressions (marginal effects), robust standard errors in parentheses (clustered on sessions), *** p < 0.01, ** p < 0.05, * p < 0.1.

	Decision to…
	(1)	(2)	(3)	(4)
	…Test	…Disclose	…Match with Unknown Type	…Match (Unconditionally)
Perfect Privacy	baseline	baseline	baseline	baseline
Imperfect Privacy	−0.056	−0.035	0.180 **	0.027
	(0.040)	(0.029)	(0.076)	(0.032)
Disclosure Duty	−0.284 ***	n.a.	0.426 ***	−0.019
	(0.058)		(0.035)	(0.016)
Period	0.008 **	0.002	−0.011 *	−0.000
	(0.004)	(0.003)	(0.006)	(0.002)
Bad Type		−0.319 ***
		(0.040)
Imperfect Privacy x		0.016
Bad Type		(0.030)
Willingness to take	−0.011 *	0.008	0.020	0.001
risks in general	(0.007)	(0.006)	(0.017)	(0.014)
Male	−0.013	−0.044 **	0.017	0.038 *
	(0.032)	(0.018)	(0.057)	(0.021)
Age	−0.004 **	0.001	−0.025	−0.024 ***
	(0.002)	(0.001)	(0.016)	(0.008)
Observations	1290	849	373	1290

presents regression analyses for behaviour in Part 2, where participants made testing, disclosure and matching decisions repeatedly with new partners in each round. The results are very similar to the results from part 1: Testing frequencies in Model (1) between Perfect Privacy and Imperfect Privacy do not differ and testing frequencies are significantly lower in Disclosure Duty compared to Perfect Privacy and Imperfect Privacy (see model (1), Wald-Test comparing coefficients of Imperfect Privacy and Disclosure Duty, χ² = 18.25, p < 0.001). Further, we find if at all a weak positive time trend in testing frequencies (see also Figure 3). Model (1) further shows that participants who are generally more willing to take risks and older participants tend to test less frequently for their type.

Model (2) focuses on disclosure behaviour. We find that bad types disclose their type significantly less often than good types. Imperfect Privacy does not affect the decision to disclose information when tested. As in part 1, matching with unknown types is more likely in Disclosure Duty as compared to Perfect Privacy and Imperfect Privacy (see model (3), Wald-Test comparing coefficients of Disclosure Duty and Imperfect Privacy, χ² = 20.61, p < 0.001). However, in part 2, matching with unknown types is also significantly more likely in Imperfect Privacy as compared to Perfect Privacy. Besides, there is a weak negative time trend in matching with unknown types Efficiency, measured in terms of unconditional matching in Model (4), does not significantly differ between Perfect Privacy and Imperfect Privacy and between Perfect Privacy and Disclosure Duty but is slightly less frequent in Disclosure Duty (0.59) compared to Imperfect Privacy (0.65, Wald-Test comparing coefficients of Imperfect Privacy and Disclosure Duty in model (4), χ² = 2.25, p < 0.097).

To summarize, our results from the repeated setting (Part 2) are consistent with the main findings in Part 2. Testing frequencies in Perfect Privacy and Imperfect Privacy are higher than in Disclosure Duty but do not differ between Perfect Privacy and Imperfect Privacy. Disclosure behaviour is similar across treatments. Matching with unknown types occurs more frequently in Disclosure Duty as compared to Perfect Privacy but efficiency does not differ strongly.

4. Discussion and Conclusions

We study theoretically and experimentally whether imperfect data privacy stops people from collecting personal information about their health type. Our theory does not provide a clear answer to this question, as it allows for multiple equilibria if the privacy institution is imperfect. The behavioural results from our laboratory experiment, however, show that people collect information irrespective of whether data privacy is perfect or imperfect—even in an abstract environment that renders the potential consequences of involuntary disclosure salient.

Information acquisition and disclosure behaviour in Imperfect and Perfect Privacy almost coincide. Two possible reasons may explain why behaviour does not differ in the two privacy institutions: First, at the testing stage in Imperfect Privacy participants may simply not take into account the probability and consequences of involuntary disclosure. Second, participants may expect that only identified good types revive a match, although (at least in the repeated version of the game) matching with unknown types is significantly more likely when privacy is imperfect compared to perfect.

Our findings provide insights relevant to policy makers for economic environments in which individuals can acquire personal information that is useful to insurers. First, we find that even when privacy cannot be guaranteed, people still acquire personal information under Consent Law. Second, we contrast information acquisition and disclosure across different privacy institutions. Thereby our results inform policy makers about the causal consequences of these different institutions. Depending on the ultimate goal of the social planner, different institutions are attractive. From a perspective of equal opportunities, a social planner might be interested in maximizing the number of insured persons. For this goal, Disclosure Duty where matching with unknown types is theoretically most likely, is preferable. Consent Law is instead advantageous if the social planner is interested in increasing information acquisition (e.g., because of benefits from early preventions), even when perfect privacy cannot be guaranteed.

An alternative interpretation of the incentive structure in our game relates to matching markets. Namely, one may interpret our game as a reduced form of a matching market in which (un)infected persons look for a sexual partner. Instead of modelling two potential partners in a symmetric way, our game simplifies the decision framework such that one partner always wants to match but might be infected (player 1) whereas the other is not infected and only wants to match with healthy partners (player 2). A policy maker interested in maximizing the number of tests and thereby eventually minimizing the frequency of infections (mismatches) will prefer Perfect Privacy.23 As in Perfect Privacy, almost all players in Imperfect Privacy test and the good types disclose their test result whereas in Disclosure Duty the most matches with unknown types occur.24

Finally, we want to note that behaviour in the experiment corresponds to qualitative differences of our theoretical predictions (more information acquisition and fewer matches with unknown types in Perfect Privacy than Disclosure Duty). However, actual behaviour does not coincide with the point predictions of the model. While testing frequencies in Perfect Privacy and Imperfect Privacy almost perfectly correspond to the theoretical prediction, testing is observed far too frequently in Disclosure Duty. Such behaviour may be driven by inequality aversion25, assumptions about other players’ risk aversion, curiosity or simple decision errors. While our design does not allow to distinguish between inequality aversion and beliefs about other players’ risk aversion, curiosity and decision errors are unlikely to explain frequent testing. First, all participants knew that they would learn their own type at the end of the experiment (irrespective of their testing decision). Second, the results from the second part of the experiment do not indicate any learning patterns in Disclosure Duty. Further, we observe more matches with unknown types in Perfect Privacy and Imperfect Privacy than predicted in the proper equilibrium with complete information acquisition. This may also be a result of efficiency concerns, since a match always increased the total surplus. Future research may try to further disentangle which of the reasons discussed above explain the observed behaviour.