On Dec 15, 2022, about two months after the first anniversary of the commencement of operation of the Personal Data (Privacy) (Amendment) Ordinance 2021 (Amendment Ordinance) introducing the new anti-doxxing regime in Hong Kong, a doxxer was sentenced to 8 months’ imprisonment after he was convicted of seven charges of “disclosing personal data without consent” under section 64(3A) of the Personal Data (Privacy) Ordinance (Cap 486). The doxxer disclosed his ex-girlfriend’s personal data, including her name, photos, residential address, private and office telephone numbers, and the name of her employer and her position, on four social media platforms without her consent after a brief relationship. This was the first sentencing case under the new regime, which took effect on Oct 8, 2021.
To combat rampant and privacy-intrusive doxxing activities, my office, the Office of the Privacy Commissioner for Personal Data, has been sparing no effort in enhancing public awareness and taking enforcement actions against such illegal acts under the new regime. In the wake of the first sentencing case, which amply illustrates the court’s condemnation of doxxing behavior, I would like to recapitulate the key features of the Hong Kong Special Administrative Region’s new doxxing offenses and highlight the enforcement work of my office over the past year.
Two-tier structure
The Amendment Ordinance introduces new doxxing offenses under a two-tier structure:
The first-tier offense is a summary offense for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to cause any specified harm or is being reckless as to whether any specified harm would be caused, or would likely be caused, to the data subject or any family member of the data subject. Any person who commits the first-tier doxxing offense is liable on summary conviction to a fine of HK$100,000 ($12,800) and imprisonment for 2 years.
The second-tier offense is an indictable offense for disclosing any personal data of a data subject in a similar way. However, to constitute the second-tier, and more serious, offense, the disclosure would need to cause specified harm to the data subject or any family member of the data subject. Any person who commits the second-tier doxxing offense is liable on conviction to a fine of HK$1,000,000 and imprisonment for 5 years.
The new regime
One year on, the new anti-doxxing regime has begun to bear fruit. Some critics claim that the regime was designed to curb freedom of speech and expression on social media, but such criticisms fly in the face of the plain language of the law and facts. It is abundantly clear from the definition of the doxxing offenses that the new regime was designed to protect individuals from intentional or reckless, and often malicious, intrusion into their privacy by the disclosure of their personal data without consent. Freedom of speech and expression does not encompass the freedom to dox others. The new regime serves to safeguard the values of our city as a civilized society and it actually underpins the freedom of speech and expression on social media platforms as it empowers the Privacy Commissioner to remove doxxing messages from those platforms which are used to silence people with different views.
Indeed, anti-doxxing laws are not unique to Hong Kong. The SAR’s anti-doxxing regime bears resemblance to similar laws in other jurisdictions including Singapore, Australia and New Zealand. Similar anti-doxxing laws were also introduced in California and Kentucky.
New criminal investigation and prosecution powers
Under the new regime, the Privacy Commissioner is empowered to conduct criminal investigations into doxxing-related summary offenses and institute prosecutions, while indictable offenses and cases which involve the commission of other criminal offenses will be referred to the Police for further investigation and consideration of prosecution.
These new powers have enabled my office to handle doxxing cases from the start of criminal investigations to the collection of evidence, and instituting prosecution actions. The streamlined process effectively expedites enforcement actions against doxxing cases.
Since the Amendment Ordinance came into effect in October 2021, up to Nov 30, 2022, my Office received 740 complaints relating to doxxing cases and initiated 109 criminal investigations. A total of 10 arrests for suspected doxxing offenses had been made, with charges laid against the arrested persons in three cases and conviction secured in two cases, including the first sentencing case on Dec 15.
Cessation notice
Apart from bringing doxxers to justice through criminal investigations and prosecutions, it is also important that doxxing messages are removed promptly to prevent further harm to the victims. In this regard, the new regime also confers statutory powers on the Privacy Commissioner to serve cessation notices to demand the removal of doxxing messages.
Up till Nov 30, 2022, my office issued more than 1,400 cessation notices to 24 online platforms, requesting them to remove over 16,500 doxxing messages. The overall compliance rate on the removal of doxxing messages is over 90 percent, notwithstanding that most of the cessation notices were served on overseas operators of online platforms.
To conclude, I take pride in reiterating that the implementation of the new regime over the past year did not affect the normal and lawful business activities in Hong Kong, nor the freedom of speech and free flow of information that Hong Kong citizens enjoy.
The author is the Privacy Commissioner for Personal Data
The views do not necessarily reflect those of China Daily.