Criminalizing Doxxing Acts: New Amendments to Hong Kong’s Data Privacy Law
On October 8, 2021, the Personal Data (Privacy) (Amendment) Ordinance 2021 containing initiatives to combat doxxing acts became effective in Hong Kong. The anti-doxxing regime under the Amendment not only defines broad and encompassing offences coupled with hefty penalties but also confers new investigative and enforcement powers to the Privacy Commissioner that have extra-territorial effect. Platform providers, operators or users should adopt appropriate approaches to potentially doxxing messages and ensure compliance with the Amendment.
Doxxing as an Offence
“Doxxing” (sometimes spelled “doxing”) is a term used for the cyberbullying technique of gathering the personal data of a target person or related person(s) (such as family members, relatives or friends) through online search engines, social platforms, discussion forums, public registers, and other means, and disclosing such personal data on the internet, social media or other public platforms. This practice has become rampant in Hong Kong in recent years, and includes numerous cases of illicit disclosures including that of patient medical records from hospitals, as well as disclosure of personal data of police and judicial officers and their family members without their consent.
Between June 2019 and 2021, the Privacy Commissioner handled over 5,800 doxxing complaint cases intrusive to personal data privacy. During that time, only about 70% of requests to online platforms by the Privacy Commissioner for removal of doxxing content were complied with. This created a need to amend the existing regime and to criminalize acts of non-consensual disclosure of personal data in order to protect the personal data privacy of the general public.
Under the Amendment, section 64 of the Ordinance was revised to provide a new two-tier doxxing offences which criminalize the disclosure of personal data where the data was disclosed without consent of the data subject, and with an intent to cause specified harm to the data subject or their family, or being reckless to such harm happening. The definition of specified harm is broad and captures (i) harassment, molestation, pestering, threat or intimidation, (ii) bodily harm or psychological harm to a person, (iii) harm causing a person to be concerned for their safety or well-being, or (iv) damage to a person’s property. The penalty for such summary offence is a fine of HK$100,000 and up to two years’ imprisonment.
An indictable offence is committed if a specified harm is caused to the data subject or a family member of the data subject due to the disclosure of personal data. The penalty for such indictable offence is a fine of up to HK$1,000,000 and up to five years’ imprisonment.
The Commissioner’s Powers and its Extra-Territorial Effect
The Privacy Commissioner is also conferred with new investigation and enforcement powers, including powers to request a person to provide materials and assistance to facilitate investigation into doxxing offences, to obtain search warrants, carry out specified investigation in premises and to seize and detain any evidence for purposes of the investigation. The Privacy Commissioner may also arrest, stop and search any person reasonably suspected of having committed doxxing offences, and may apply to the Hong Kong Court of First Instance for an injunction against a person who engaged, is engaging or is likely to engage in conduct which contravenes the doxxing offences.
The Privacy Commissioner may serve a notice in the case of doxxing if the data subject is a Hong Kong resident or is present in Hong Kong regardless of whether the disclosure was made in Hong Kong. Cessation notices may also be served inside or outside of Hong Kong depending on whether the doxxer or the service provider is inside or outside of Hong Kong. The Amendment Ordinance equips the Privacy Commissioner with the flexibility necessary to take appropriate action given the global reach and vast nature of the internet. Any doxxer or service provider served with a cessation notice that either fails to comply or establish an appropriate defence may commit a criminal offence and be subject to penalties or imprisonment.
To read the original publication regarding this Amendment, please click here.
