People's decisions do not happen in a vacuum; there are multiple factors that may affect them. There are external determinants, such as cost/benefit calculation of decision outcomes. There are also internal factors, such as attitudes, personality, emotions, age, and nationality. Frequently, the latter have a final say on the decision at hand, and similar determinants are triggered during the digital interaction when people make decisions about their privacy.

The current digital privacy landscape is filled with recurring security breaches and leaks of personal information collected by online service providers. Growing dependency on Internet-connected devices and increasing privacy risks prompted policy makers to protect individuals' right to privacy. In Europe, the General Data Protection Regulation requires companies to provide adequate information about their data collection and processing practices to users, to increase privacy awareness and enable better decision making. Regardless, currently there is no sufficient, usable technology, which could help people make improved privacy decisions, decreasing over-disclosure and oversharing. Hence, multidisciplinary researchers aim at developing new privacy-enhancing solutions. To define such solutions and successfully convey data provision and processing practices, potential risks, or harms resulting from information disclosure, it is crucial to understand cognitive processes underpinning privacy decisions.

In this thesis, we examine privacy decisions and define factors that influence them. We investigate the attitude-behaviour relationship and identify privacy concerns affecting perceptions of privacy. Additionally, we examine factors influencing information sharing, such as emotional arousal and personality traits. Our results demonstrate that there is a relationship between privacy concerns and behaviours, and that simplified models of behaviour are insufficient to predict privacy decisions. Our findings show that internal factors, such as nationality and culture, emotional arousal, and individual characteristics, affect privacy decisions. Based on our findings, we conclude that future models of privacy should incorporate such determinants. Further, we postulate that privacy user interfaces must become more flexible and personalised than the current solutions.

Growing dependency on Internet-connected devices and increasing privacy risks prompted policymakers to protect individuals’ right to privacy. In Europe, the General Data Protection Regulation requires companies to provide users with adequate information about data collection and processing practices to increase privacy awareness and enable better decisions. Hence, multidisciplinary researchers aim at developing new privacy-enhancing solutions. However, to develop such solutions it is crucial to understand cognitive processes underpinning privacy decisions.

This thesis objective is to investigate privacy behaviours. We identify privacy concerns affecting perceptions of privacy and examine factors influencing information sharing. We show that simplified models of behaviour are insufficient predictors of privacy decisions, and that demographic characteristic, emotion and personality affect privacy attitudes and behaviours. Based on our findings we conclude that future models of privacy and designs of privacy user interfaces must incorporate such behavioural determinants.