## 2 Overview of Privacy Challenges and Disclosure Risks in Organisational Data Sharing
### Challenges in Organisational Data Sharing  
Data sharing is a widely acknowledged practice that enhances organisational efficiency and performance by providing insights into processes and technologies. However, it can present challenges, particularly in relation to privacy concerns [12; 13]. The nature of data sharing varies among organisations, depending on their business models, such as B2B, B2C, or C2C, which dictate distinct relationship models and privacy policies [14]. Privacy policies are crucial for organisations as they ensure compliance with privacy regulations and safeguard customer privacy. These policies serve as legal documents, informing individuals about how their personal data are collected, processed, and shared [15; 16]. Nevertheless, the implementation of privacy policies can differ between organisations, leading to discrepancies between policy statements and actual practices. The shift towards cross-organisational data sharing, especially in models like B2B, B2C, and C2C, can enhance organisational performance by exchanging personal data for services or goods [17]. However, there is currently no standardised guidance on disclosing personal data-collection details in privacy policies, resulting in variations between organisations' policies [14]. This lack of standardisation can confuse consumers, who may not fully grasp how their data is managed. Intra-organisational data sharing, as practiced by Meta (the parent company of Facebook, Instagram, and WhatsApp), is valuable when internal systems and customer demographics align [12; 18]. However, compliance with privacy regulations can vary based on the sensitivity of the data collected. For example, healthcare organisations require stricter compliance due to the sensitivity of medical data compared to e-commerce organisations [14]. Privacy policies play a crucial role in protecting customer privacy, but comprehending these documents can be a challenge due to their often lengthy and complex nature [19; 20]. Research conducted in the United States revealed that citizens would need to spend an average of 40 min per day just to read all the privacy policies they encounter [21]. Moreover, privacy policies may be influenced by other privacy regulations from various regions worldwide. One of the significant difficulties organisations encounter when striving for transparency in their privacy policies is in how they use and disclose personal data. Some organisations adopt a permissive approach, sharing personal data with business partners or affiliates, while others primarily use this data internally, as seen with Meta disclosing user information across its subsidiary platforms like Facebook and Instagram [18]. Although these organisations attempt to explain in their privacy policies how personal data are protected, they often fail to provide information about how it is protected or where the data are utilised. While their privacy policies may meet legal requirements from industry to government levels, the vague language employed can increase the privacy risk associated with personal data. Ensuring the accuracy of information within privacy policies is vital for maintaining customer trust regarding how organisations handle personal data. For instance, Meta, the parent company of Facebook and Instagram, previously provided false information in 2014 regarding automated profile matching between Facebook and WhatsApp. Subsequently, Meta updated its terms of service, requiring users to agree to the new terms. In 2021, Meta modified its privacy policy to allow the sharing of personal information with its affiliates [22; 23]. This highlights the evolving nature of privacy policies and their potential impact on users' data privacy. Privacy policies serve a critical role in defining an organisation's procedures for processing and disclosing personal data [16]. These procedures, known as privacy practices, are essential commitments made by organisations.