The two-tier structure

The Amendment Ordinance introduces new doxxing offences under a two-tier structure:

• The first-tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent, and the discloser has an intent to cause any specified harm or is being reckless as to whether any specified harm would be caused, or would likely be caused, to the data subject or any family member of the data subject. Any person who commits the first-tier doxxing offence is liable on summary conviction to a fine of HKD 100,000 (approx. €11,670) and to imprisonment for two years.
• The second-tier offence is an indictable offence for disclosing any personal data of a data subject in a similar way, but this offence further requires that the disclosure causes specified harm to the data subject or any family member of the data subject. Any person who commits the second-tier doxxing offence is liable on conviction on indictment to a fine of HKD 1 million (approx. €116, 730) and to imprisonment for five years.

New criminal investigation and prosecution powers

To effectively carry out enforcement actions against doxxers, the PCPD is empowered under the Amendment Ordinance to conduct criminal investigations into doxxing-related offences. New criminal investigation powers exercisable under the Amendment Ordinance include the power to require materials and assistance by issuing a written notice, power to apply for a warrant from the Court to search premises and access electronic devices, power to access electronic devices without a court warrant under urgent circumstances where it is not reasonably practicable to obtain such warrant, and the power to stop, search, and arrest.

Depending on the gravity of the cases, prosecution may be instituted in the Privacy Commissioner's name for summary offences in the Magistrates' Court, while cases involving the commission of indictable offences or other criminal offences will be referred to the Hong Kong Police Force for further investigation and consideration of prosecution.

These new powers have enabled the PCPD to handle doxxing cases from the start of criminal investigations to the collection of evidence and instituting of prosecution actions. The streamlined process effectively expedites enforcement actions against doxxing cases. It is noteworthy, for instance, that the PCPD successfully secured the first conviction in relation to the new doxxing offences in October 2022, less than four months after the suspect was arrested in June 2022. In that case, a doxxer, who disclosed his ex-girlfriend's personal data, including her name, photos, residential address, private and office telephone numbers, and the name of her employer and her position, on four social media platforms without her consent after a brief relationship, was convicted of seven charges of the first-tier doxxing offence, namely, 'disclosing personal data without consent', and sentenced to eight months' imprisonment.

Since the Amendment Ordinance came into effect in October 2021, up to 31 December 2022, the PCPD received a total of 791 complaints relating to doxxing and initiated 114 criminal investigations. Since the first arrest made by the PCPD in December 2021, as of 31 December 2022, a total of 12 arrests for suspected doxxing offences had been made.

Cessation notice

Apart from bringing perpetrators of doxxing activities to justice through criminal investigations and prosecutions, it is paramount that doxxing messages are removed promptly to prevent further harm to the victims.

Given the borderless nature of the internet, the Amendment Ordinance confers on the PCPD statutory powers with extra-territorial effect to serve cessation notices to demand the removal of doxxing messages, regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a person in Hong Kong, or, in relation to an electronic message, a service provider outside Hong Kong that is able to take a cessation action.

Up to the end of 2022, the PCPD issued more than 1,500 cessation notices under the new regime to 26 online platforms, requesting the removal of over 17,000 doxxing messages. The overall compliance rate on the removal of doxxing messages is over 90%, notwithstanding that most of the cessation notices were served on operators of online platforms which were operated overseas.

Role of social media platforms

While the PCPD will continue to proactively monitor doxxing activities and issue cessation notices to online platforms wherever necessary, it is important to emphasise that operators of online platforms, especially social media platforms, have a responsibility to maintain a clean and safe online environment for their users. In this regard, it is observed that the privacy policy and terms of service of social media platforms commonly provide that users may not post unlawful and/or harmful contents, including those that infringe upon other's privacy, and that operators have in place policies to remove or restrict access to such contents, or even disable relevant users' accounts in cases of serious or repeated violation. In line with their privacy policies and terms of service, social media platform operators should bear responsibility in keeping an eye on the contents being posted on their platforms and taking prompt actions by themselves to remove any doxxing contents.

In addition, the use of social media platforms has become more prevalent among children nowadays, who may lack awareness about or ability in safeguarding their privacy. When compared to adults, children are more prone to over-sharing their personal data online without appreciating the associated risks involved, such as being subject to doxxing, cyberbullying, or even blackmail. Timely removal of doxxing contents involving children by platform operators is therefore pivotal to protecting the safety of minors in the online world. Other than imposing a minimum age requirement for users, platform operators should adopt an age-appropriate approach to ensure that they protect and respect children's privacy. This may include, for example, ensuring that the default setting for sharing personal data is as restrictive as possible, and providing reminders and warnings to young users in age-appropriate language.

Concluding remarks

It is pleasing to see that the new anti-doxxing regime has begun to bear fruits, and the PCPD can take pride that the implementation of the new regime over the past year did not affect the normal and lawful business activities in Hong Kong, nor the freedom of speech and free flow of information that Hong Kong citizens enjoy.

Ada Chung Lai-Ling Privacy Commissioner for Personal Data, Hong Kong, China