Most people think digital privacy is about data breaches. Leidner and Tona's CARE framework says it is really about whether your dignity can survive digitization.
I was reading through the cybersecurity and privacy section of my study materials when I caught myself doing something I did not expect. Every time I saw the word "privacy," my brain automatically translated it to "data breach." Company loses customer records. Hackers expose passwords. Regulators levy fines. That whole loop is what privacy means in most IS research and in most public conversation. And then Leidner and Tona (2021) stopped me cold with a framework that says, basically, you are looking at the wrong thing.
CARE stands for claims, affronts, response, and equilibrium. Not consciousness, agency, relationships, and ethics. An older broken source record in my files had that wrong acronym, and my study hub flag specifically warns against using it. The verified local PDF is clear: claims, affronts, response, equilibrium. These four words are not a privacy framework. They are a dignity framework. And the distinction matters more than I first realized.
When we talk about privacy in IS, we usually work inside one of a few well-worn grooves. Malhotra et al. (2004) give us IUIPC, which breaks privacy concern into collection, control, and awareness. Acquisti et al. (2015) show that privacy behavior is uncertain, context-dependent, and malleable: people do not behave like rational calculators trading off costs and benefits the way the privacy calculus model assumes. Zalmanson et al. (2022) add the trust mechanism: social cues from a platform can increase private information disclosure, which helps service personalization but also raises risk. All of this is important. None of it is wrong. But all of it treats privacy as an information control problem. Will I share my data? How much control do I have? What are the consequences of disclosure?
Leidner and Tona move the question upstream. Before you decide whether to share your data, you already have a claim about how you should be treated. That claim is about dignity, which is the expectation of respect, autonomy, recognition, privacy, and fair treatment. When a data practice humiliates you, reduces your agency, misrecognizes your merit, exposes you unfairly, or treats you as nothing but a data profile, that is not a privacy violation in the narrow sense. That is an affront to your dignity. And the three forms of dignity that can take an affront are behavioral dignity (what you earn through action), meritocratic dignity (what you earn through achievement), and inherent dignity (what you have simply by being a person).
This reframing hits harder when you see what it does to the risk side. Kane et al. (2021) warn that machine learning can create what they call Informania, which is a state where systems use behavioral data to shape people in ways that reduce autonomy. This is not just a data breach. This is a system that watches, profiles, nudges, and eventually controls, all while optimizing for platform objectives rather than the person's own. The affront is not that someone stole your data. The affront is that the system treats your behavior as raw material for its goals, without your meaningful participation in what that means for your life. Kane et al. do not stop at the diagnosis. They propose a design theory for emancipatory assistants: ML systems designed to protect user agency rather than erode it. The design response is built into the theory, and I think that is what makes CARE more than a critique.
Zalmanson et al. (2022) show a quieter version of the same problem. When a platform creates trust cues (design elements that signal safety and responsiveness), users disclose more personal information. Sometimes this is genuinely beneficial. A health platform that earns trust can help patients manage care better. A learning platform that adapts to disclosed needs can support students. But the moment trust becomes a mechanism for extracting more data, the relationship shifts. The person is no longer being recognized. They are being harvested. CARE gives me the language to say this precisely: the trust cue creates a claim (I expect to be treated well here), the disclosure follows, and then the misuse creates an affront (my willingness was exploited, not respected).
The benefit side of CARE matters as much as the risk side, and I think this is where most summaries of the theory sell it short. Leidner and Tona are not saying digitalization is only harmful. Digital technologies can support dignity when they improve access, recognition, participation, personalization, and social inclusion. Baird and Maruping (2021) add that agentic systems can increase human capability rather than reduce it, but only when delegation is well designed. If the human can appraise the system, distribute tasks wisely, and coordinate the outcome, then the technology is not just safe. It is dignity-affirming. The question is never just "is the data secure?" It is "does this system help people act with more agency, recognition, and respect, or does it make them smaller?"
Kattnig et al. (2024) push this into fairness territory in a way that connects directly to dignity. They show that fairness is both a technical question and a legal one. A model can satisfy every technical fairness metric and still feel deeply unfair to the people it classifies. A legally compliant system can still treat people as invisible, replaceable, or unable to challenge a decision. That gap between metric and experience is exactly what CARE is built to name. When you are reduced to a profile, denied a loan, flagged by an algorithm, and you cannot even find out why, the problem is not that your data was breached. The problem is that you were affronted. Your claim to fair treatment, your meritocratic dignity, your inherent dignity: all three were violated while every privacy policy on the platform remained technically intact.
What I find most useful about CARE is the equilibrium framing. This is not a theory that says digitalization is bad. It asks whether the current configuration of digital practices creates a stable dignity equilibrium or generates repeated affronts that call for response. Responses can come from individuals, organizations, or regulators. And when equilibrium breaks, the repair is not a stronger firewall. The repair needs to address dignity directly. Can people act with autonomy? Are they recognized? Are they treated as ends, not merely as means?
Dignity affronts are quieter than breaches. A person who stops applying for jobs because an algorithm keeps filtering them out is experiencing an affront, not a breach. A student who self-censors on a learning platform because they do not trust how their data will be used is experiencing disequilibrium, not a hack. CARE gives me a way to name these as theory-backed harms, not just soft feelings.
When I write about privacy now, I catch myself before I let the conversation collapse into breach counts. I want to ask: what claims are people making? What affronts are the data practices creating? What responses are available? And is the system moving toward equilibrium, or away from it?
About the author
Share
More notes
Related notes