Is there any study, method or framework that have looked into how to quantify the privacy risk from an information exposure? Specifically by addressing the subjective nature of privacy risk.
the good privacy professional will tell that managing privacy is all ... Organizations commonly lack appropriately defined information-handling procedures.. they are no empirical methods to determine which ... report a series of experiments to measure perceived privacy risk, which is based on ... Information systems increasingly use personal information in sensitive ways, ... could be motivated by a privacy risk score derived from the data exposed.
Risk management has a phase of risk analysis. The risk analysis has a quantitative approach that is used to score assets according to the corresponding threats.
Adding to what Zeyad said, sometimes a qualitative approach is also used to depict subjective assessment of risk. Anchors such as 'not at all' to 'very much' can be used. It depends on the assessor which approach s/he adopts.
Currently the most popular and successful privacy protection framework is the Differential Privacy framework:
Article The Algorithmic Foundations of Differential Privacy
However, due to some weakness of this framework to protect privacy, others suggested many other privacy protection frameworks, such as our work:
Preprint Information Theory of Data Privacy
This paper suggested an information privacy framework. This is a variant of Shannon's information theoretic framework to the encryption systems and measures the privacy by using the amount of information obtained by each adversary.This framework's many properties are not proved, which is the work we are doing.