{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,1]],"date-time":"2026-04-01T20:29:05Z","timestamp":1775075345549,"version":"3.50.1"},"reference-count":46,"publisher":"SAGE Publications","issue":"3","license":[{"start":{"date-parts":[[2023,2,21]],"date-time":"2023-02-21T00:00:00Z","timestamp":1676937600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/journals.sagepub.com\/page\/policies\/text-and-data-mining-license"}],"funder":[{"DOI":"10.13039\/501100007129","name":"Shandong Provincial Natural Science Foundation","doi-asserted-by":"crossref","award":["ZR2022QG065"],"award-info":[{"award-number":["ZR2022QG065"]}],"id":[{"id":"10.13039\/501100007129","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":["journals.sagepub.com"],"crossmark-restriction":true},"short-container-title":["Journal of Information Technology"],"published-print":{"date-parts":[[2023,9]]},"abstract":"<jats:p> Corporate data protection malpractices are not uncommon, especially in contemporary technological environments. Embracing a regulatory view, this study attempts to advance a taxonomy of prevailing corporate data protection practices and their causal mechanisms by analyzing cases where organizations were fined for violating data protection legislation. Selecting the General Data Protection Regulation (GDPR) enacted by the European Union (EU) as our benchmark, this study employs an iterative taxonomy development technique as guidance and conducts a thematic analysis on 875 cases of GDPR enforcement. In so doing, we derive a conceptual model comprising 6 focal categories and 28 subcategories of prevailing corporate data protection malpractices existing within organizations as well as 4 main categories and 22 subcategories of causal mechanisms underlying these identified malpractices. Empirical findings from this study not only reinforce corporate data protection malpractices established in prior research but also yield novel malpractices that have been neglected in previous work. From a pragmatic standpoint, this study yields invaluable insights into the prevention and resolution of corporate data protection malpractices for practitioners. <\/jats:p>","DOI":"10.1177\/02683962231155937","type":"journal-article","created":{"date-parts":[[2023,1,27]],"date-time":"2023-01-27T04:32:16Z","timestamp":1674793936000},"page":"319-333","update-policy":"https:\/\/doi.org\/10.1177\/sage-journals-update-policy","source":"Crossref","is-referenced-by-count":3,"title":["Toward a taxonomy of corporate data protection malpractices and their causal mechanisms: A regulatory view"],"prefix":"10.1177","volume":"38","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-8864-2790","authenticated-orcid":false,"given":"Haiping","family":"Zhao","sequence":"first","affiliation":[{"name":"Department of Information Management, School of Economics and Management, China University of Petroleum, Qingdao, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5730-3465","authenticated-orcid":false,"given":"Na","family":"Jiang","sequence":"additional","affiliation":[{"name":"Department of Management, Faculty of Business and Management, BNU-HKBU United International College, Zhuhai, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhao","family":"Cai","sequence":"additional","affiliation":[{"name":"Department of Entrepreneurship, Marketing and Management Systems, Nottingham University Business School China, University of Nottingham Ningbo China, Ningbo, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Eric T. K.","family":"Lim","sequence":"additional","affiliation":[{"name":"School of Information Systems and Technology Management, UNSW Business School, UNSW Sydney, Sydney, Australia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4245-541X","authenticated-orcid":false,"given":"Chee-Wee","family":"Tan","sequence":"additional","affiliation":[{"name":"Department of Digitalization, Copenhagen Business School, Copenhagen, Denmark"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"179","published-online":{"date-parts":[[2023,2,21]]},"reference":[{"key":"bibr2-02683962231155937","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/9905.001.0001"},{"key":"bibr3-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2020.101431"},{"key":"bibr4-02683962231155937","doi-asserted-by":"publisher","DOI":"10.2307\/41409971"},{"key":"bibr5-02683962231155937","doi-asserted-by":"publisher","DOI":"10.2307\/3250956"},{"key":"bibr6-02683962231155937","volume-title":"Australian Discussion Paper, Topic 3. Sixth Un Congress on the Prevention of Crime and the Treatment of Offenders","author":"Braithwaite J","year":"1979"},{"key":"bibr7-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1191\/1478088706qp063oa"},{"issue":"1","key":"bibr8-02683962231155937","first-page":"62","volume":"5","author":"Brown M","year":"2004","journal-title":"Journal of Electronic Commerce Research"},{"key":"bibr9-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/S0047-2352(00)00036-2"},{"key":"bibr10-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2017.01.008"},{"key":"bibr11-02683962231155937","volume-title":"First on CNN Business: Moody\u2019s is spending $250\u00a0million to measure the risk of America\u2019s biggest companies getting hacked","author":"CNN","year":"2021"},{"key":"bibr12-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/j.emj.2019.01.007"},{"key":"bibr13-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1111\/1540-4560.00067"},{"key":"bibr14-02683962231155937","first-page":"35","volume":"3","author":"Duckham M","year":"2006","journal-title":"Dynamic & Mobile GIS: Investigating Change in Space and Time"},{"key":"bibr15-02683962231155937","first-page":"31","volume":"2","author":"Dowling DC,","year":"2000","journal-title":"Journal of Alternative Dispute Resolution in Employment"},{"issue":"2","key":"bibr16-02683962231155937","first-page":"859","volume":"44","author":"Erickson A","year":"2018","journal-title":"Brooklyn Journal of International Law"},{"key":"bibr17-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1108\/INTR-01-2019-0003"},{"key":"bibr18-02683962231155937","first-page":"L119","volume":"49","author":"Union European","year":"2016","journal-title":"The Official Journal of the European Union"},{"key":"bibr19-02683962231155937","volume-title":"Adequacy Decisions","author":"Union European","year":"2021"},{"key":"bibr20-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1504\/IJEB.2008.020676"},{"key":"bibr21-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1111\/j.1564-913X.2014.00197.x"},{"key":"bibr22-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1080\/13600834.2019.1571473"},{"key":"bibr23-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/j.im.2009.06.005"},{"key":"bibr24-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-25047-2_13"},{"key":"bibr25-02683962231155937","volume":"10","author":"Greenleaf G","year":"2017","journal-title":"145 Privacy Laws & Business International Report"},{"key":"bibr26-02683962231155937","doi-asserted-by":"publisher","DOI":"10.54648\/GPLR2020093"},{"key":"bibr27-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1111\/1540-5893.3701002"},{"key":"bibr28-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1080\/1097198X.2019.1569186"},{"key":"bibr29-02683962231155937","volume-title":"Merriam-Webster.com","author":"Malpractice","year":"1828"},{"key":"bibr30-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1057\/ejis.2012.26"},{"key":"bibr31-02683962231155937","doi-asserted-by":"publisher","DOI":"10.2307\/41409969"},{"key":"bibr32-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1177\/014920638601200408"},{"key":"bibr33-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1145\/1284621.1284627"},{"key":"bibr34-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1080\/07421222.2015.1099390"},{"key":"bibr35-02683962231155937","doi-asserted-by":"publisher","DOI":"10.2307\/249774"},{"issue":"5","key":"bibr36-02683962231155937","first-page":"1693","volume":"57","author":"Schwartz VL","year":"2016","journal-title":"Boston College Law Review"},{"key":"bibr37-02683962231155937","volume-title":"Managing Privacy: Information Technology and Corporate America","author":"Smith HJ","year":"1994"},{"key":"bibr38-02683962231155937","doi-asserted-by":"publisher","DOI":"10.2307\/249477"},{"key":"bibr39-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1177\/0021943610369783"},{"key":"bibr40-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1002\/asi.24342"},{"key":"bibr41-02683962231155937","volume-title":"Basics of qualitative research: Techniques and procedures for developing grounded theory","author":"Strauss A","year":"1998"},{"key":"bibr42-02683962231155937","doi-asserted-by":"publisher","DOI":"10.25300\/MISQ\/2016\/40.1.01"},{"key":"bibr43-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1145\/272287.272299"},{"key":"bibr1-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1177\/0893318907306033"},{"key":"bibr45-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2011.12.008"},{"key":"bibr46-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1002\/asi.24232"},{"key":"bibr47-02683962231155937","doi-asserted-by":"publisher","DOI":"10.1057\/jit.2010.4"}],"container-title":["Journal of Information Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/02683962231155937","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/full-xml\/10.1177\/02683962231155937","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/journals.sagepub.com\/doi\/pdf\/10.1177\/02683962231155937","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,3,1]],"date-time":"2025-03-01T04:43:28Z","timestamp":1740804208000},"score":1,"resource":{"primary":{"URL":"https:\/\/journals.sagepub.com\/doi\/10.1177\/02683962231155937"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,2,21]]},"references-count":46,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2023,9]]}},"alternative-id":["10.1177\/02683962231155937"],"URL":"https:\/\/doi.org\/10.1177\/02683962231155937","relation":{},"ISSN":["0268-3962","1466-4437"],"issn-type":[{"value":"0268-3962","type":"print"},{"value":"1466-4437","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,2,21]]}}}