|
On 29 September 2021, the Hong Kong Legislative Council passed a bill to reform the Personal Data (Privacy) Ordinance (Cap. 486) (PDPO) by introducing a two-tier offence to criminalise doxxing acts, conferring new enforcement powers on the Hong Kong Privacy Commissioner to prosecute doxxing offences and issue cessation notices with extra-territorial effect to demand the removal of doxxing contents by both Hong Kong persons and non-Hong Kong service providers.
Background
The new anti-doxxing provisions serve as the Hong Kong Government’s response to combat rampant doxxing activities, which saw an uptick from mid-2019. Between June 2019 and June 2021, the Privacy Commissioner received more than 5,800 doxxing-related cases[1]. These included cases where persons committed doxxing acts inflicting harm on targeted victims, their family members or close relations, by collating their personal data via search engines, social media platforms or the public domain and subsequently disclosing the same on the Internet and other open platforms. Victims included government officials, judges, politicians, police officers and celebrities. Personal data disclosed included names, photographs, phone numbers, addresses and occupations, as well as sensitive personal data, such as Hong Kong Identity Card numbers and dates of birth. The victims suffered various types of harm, such as fear of harassment, intimidating calls and cyberbullying.
New anti-doxxing provisions are considered necessary, as the existing section 64 of the PDPO relied on by the Privacy Commissioner to counter doxxing acts, is not intended to combat such acts. Under section 64, a person commits an offence if he discloses personal data of a data subject obtained from a data user without the data user’s consent, either with an intent to obtain gain or benefit or to cause loss in money or property to the data subject or the disclosure causes psychological harm to the data subject. Yet, in doxxing cases where personal data is often leaked anonymously or repeatedly reposted, identifying the sources of the data is difficult, let alone being able to show that the data was obtained from the data user “without the data user’s consent”. The new provisions also seek to remedy the lack of mandatory powers for the Privacy Commissioner to demand service providers to remove doxxing content.
Anti-Doxxing Provisions
|
1.
|
The new two-tier offences to criminalise doxxing acts
New two-tier anti-doxxing offences[2] will replace the existing section 64(2) of the PDPO[3]:
-
Under the first-tier summary offence, a person commits an offence if he discloses personal data of a data subject without his consent, with an intent to cause specified harm to the data subject or any of his family members, or being reckless as to whether any specified harm would be or would likely be caused to the data subject or his family member. The offence is punishable by a HK$100,000 fine and 2 years imprisonment.
- Under the second-tier indictable offence, a person commits an offence if in addition to the elements of the first-tier offence, any specified harm is actually caused to the data subject or any of his family members as a result of the disclosure. The offence is punishable by a HK$1,000,000 fine and 5 years imprisonment.
Under these provisions, “specified harm” is defined broadly to protect data subjects, and covers harassment, molestation, pestering, threat or intimidation to the person, both bodily harm or psychological harm, harm causing the person to be reasonably concerned for his safety or well-being or damage to the property of the person[4].
Existing defences available under section 64 will be maintained. Where the discloser can show that (a) he reasonably believed that the disclosure was necessary for preventing or detecting crime; (b) the disclosure was required or authorised by law or any court order; (c) he reasonably believed the data user had consented to the disclosure; or (d) the disclosure was for news activity purposes and he reasonably believed that the disclosure was in the public interest, the discloser is able to raise a defence.
|
|
2.
|
Privacy Commissioner conferred with new criminal investigation and prosecution powers
The Privacy Commissioner currently lacks criminal investigation and prosecution powers and relies on the Hong Kong Police Force and the Department of Justice to conduct investigations and prosecutions. To ensure effective investigation and prosecution of doxxing cases, the Government confers new investigation and enforcement powers on the Privacy Commissioner including the powers to:
-
request relevant materials, documents and information from any person, or require any person to answer relevant questions, to facilitate the carrying out of an investigation into doxxing offences. A person commits an offence if he fails to comply with the Commissioner’s request without reasonable excuse or he provides false or misleading materials, documents or information with an intent to defraud[5];
-
stop, search and arrest without warrant any person reasonably suspected of committing certain doxxing offences[6];
-
apply for a warrant from the Magistrate to enter and search the premises, carry out investigation and seize materials or access and search (and decrypt material) stored in an electronic device[7];
-
apply to the Court of First Instance for an injunction against a person who engaged, is engaging or is likely to engage in conduct which contravenes the new two-tier doxxing offences[8] .
The Privacy Commissioner may initiate a prosecution in his name in respect of certain doxxing summary offences, including any conspiracy to commit such offences, at the Magistrates’ Court. [9] For moe serious cases, the Commissioner may refer them to the Hong Kong Police Force or the Department of Justice for follow-up.
|
|
3.
|
Power to issue cessation notices with extra-territorial effect
The Privacy Commissioner does not currently have mandatory powers to demand online platforms to remove web links related to doxxing contents. The new anti-doxxing provisions empower the Privacy Commissioner to issue cessation notices[10] with extra-territorial effect to Hong Kong persons or non-Hong Kong service providers to demand their taking of cessation actions, where:
|
(i)
|
there is a disclosure (whether within or outside Hong Kong) of personal data of a data subject made via a written or electronic message, without the data subject’s consent and the first-tier offence elements are present;
|
|
(ii)
|
the data subject is a Hong Kong resident or is present in Hong Kong when the disclosure is made; and
|
|
(iii)
|
the Hong Kong person or non-Hong Kong service provider would be able to take the cessation action.
|
The power to serve such cessation notices to curb disclosure of personal data which occurs outside Hong Kong and on non-Hong Kong service providers would catch scenarios of disclosure via the Internet where such disclosure may be outside Hong Kong and prevent circumvention by disclosers who commit doxxing acts outside Hong Kong.
Depending on circumstances, the Privacy Commissioner may demand (i) removal of written or electronic doxxing messages from electronic platforms (e.g. websites, online applications); (ii) discontinuance of hosting services for the part or whole of the platform on which the message is published; or (iii) ceasure or restriction of access to the message or the relevant platform on which the message is published.
Failure to comply with cessation notices may result in a fine of HK$50,000 and 2 years imprisonment for a first conviction, unless a defence can be established. Whilst persons served with a cessation notices may appeal within 14 days after service of the notice, they are required to comply with the notice within the designated timeframe pending the appeal in any event.
|
Implications for Businesses
The introduction of the anti-doxxing provisions demonstrates the Government’s resolve to combat doxxing acts which infringe personal data privacy of victims and cause them harassment and distress. Disclosure of personal data would be penalised as long as the requisite intent or recklessness is demonstrated, even in the absence of actual harm caused to the victims. The new provisions also give the Privacy Commissioner greater enforcement and investigation powers, e.g. by directing the removal of doxxing content, and failure to comply would be a criminal offence.
It remains to be seen how the Privacy Commissioner will interpret and enforce these provisions. This would partly be affected by whether they can recruit sufficient staff who are experienced in dealing with this kind of investigation. Concerns have been raised by multi-national companies, such as the social media platforms, as to whether the new law and its wide scope might harm trade and discourage service providers to make further investments in Hong Kong. We hope that the Privacy Commissioner will issue guidelines or FAQ on the new provisions to guide citizens and businesses away from any potential breach. Businesses should be prepared to review and/or invest in measures to curb doxxing and/or ensure that their staff are well trained to respond to cessation notices. In particular, businesses with cross-jurisdictional offices should review their internal coordination processes with local offices to ensure prompt follow-up action would be taken in response to cessation notices.
This anti-doxxing reform appears to have taken priority over other reforms to the PDPO proposed by the Privacy Commissioner back in January 2020, including introducing mandatory data breach notification and conferring on the Privacy Commissioner the power to administer fines. However, with the successful passing of the new law, we might see the implementation of other reforms in the next term of the Legislative Council.
[1] Say "No" to Doxxing. https://www.pcpd.org.hk/english/complaints/doxxing/doxxing.html
[2] New section 64(3A) and section 64(3C)
[3] Under section 64(2) of the PDPO, a person commits an offence if (a) the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent; and (b) the disclosure causes psychological harm to the data subject. Under section 64(3) of the PDPO, a person who commits an offence under section 64(2) is liable on conviction to a fine of $1,000,000 and to imprisonment for 5 years.
[4] The new section 64(6).
[5] New section 66D and section 66E.
[9] New section 64C
[10] New sections 66J to 66O
|