Introduction

Between June 2019 and April 2021, the Government and the Office of the Privacy Commissioner for Personal Data (“Commissioner”) received over 5,700 doxxing-related complaints. With an aim to combating doxxing acts that are intrusive to personal data privacy, the Constitutional and Mainland Affairs Bureau proposed amendments to the Personal Data (Privacy) Ordinance (Cap. 486) (“PDPO”) on 11 May 2021. The amendment bill was passed on 29 September 2021 and the Personal Data (Privacy) (Amendment) Ordinance 2021 (“Amendment PDPO”) has come into force on 8 October 2021. To facilitate implementation of the Amendment PDPO, the Commissioner issued a guideline in October 2021 to provide guidance on the scope of doxxing offences and powers of the Commissioner regarding doxxing acts under the Amendment PDPO (“Guideline”).

Scope of doxxing offences

Doxxing generally refers to the act of gathering of the personal data from different sources and subsequently revealing such personal data on the internet with a malicious intent. Under the old PDPO, it is an offence when a person discloses personal data of a data subject without consent from data users and cause harm to the data subject.

Section 64 of the Amendment PDPO introduces two-tier offences to criminalize the intentional or reckless disclosure of personal data without consent from data subjects. If the doxxing act has caused actual “specified harm” to data subjects or their family members, the person commits the second tier doxxing offence and is liable to a maximum penalty of a fine of HK$ 1 million and to imprisonment for 5 years. Without the proof of actual “specified harm”, the person can still commit the first tier doxxing offence and is liable to a maximum penalty of a fine at level 6 (i.e. HK$ 100,000) and to imprisonment for 2 years. Ancillary offences are also created in the case of non-compliance or non-cooperation with the criminal investigations and cessation notices issued by the Commissioner.

The “specified harm” is widely defined under the Amendment PDPO and consists of four limbs, namely (i) harassment, molestation, pestering, threat or intimidation to person; (ii) bodily harm or psychological harm to the person; (iii) harm causing the person reasonably to be concerned for the person’s safety or well-being; and (iv) damage to the property of the person. Examples are given in the Guideline for each limb of the “specified harm” for reference, including nuisance calls and messages, misuse of personal data for loan application, bullying a complainant’s children at school and disturbance at the wedding ceremony.  

Commissioner’s powers

Power to conduct criminal investigation and institute prosecution

Under the old PDPO, the Commissioner had to refer cases to the police and the Department of Justice for instituting prosecution. With the Amendment PDPO, the new investigation and enforcements powers include:

1.    power to compel information production, interview attendance and other assistance (section 66D of the Amendment PDPO);

2.   power to enter and search premises, and seize, remove and detain any material in the premise with a warrant (section 66G(2) of the Amendment PDPO);

3.    access, seize and detain electronic devices, and decrypt, search for and reproduce any material stored in the devices, with magistrate’s warrant or without one in case of urgency (section 66G(3), (8) of the Amendment PDPO);

4.    stop, search and arrest any person who is reasonably suspected of committing certain PDPO offences, including the doxxing offences (section 66H of the Amendment PDPO); and

5.    prosecute the first tier doxxing offence and other summary offences in the Commissioner’s own name and refer all indictable offence to the police for follow-up and the Department of Justice for instituting prosecution (section 64C of the Amendment PDPO).

Power to demand cessation of doxxing contents

The Commissioner is also given a new power to issue cessation notices to compel the removal of contents disclosed in way that is reasonably believed to constitute doxxing offences, and such notices can be served on disclosers of doxxing content, operator of electronic platforms, internet service providers or hosting service providers. In the scenario that the subject message is in an electronic form, the Commissioner can serve a cessation notice on a non-Hong Kong service provider directing it to take cessation actions. Non-compliance of cessation is itself a criminal offence punishable by fine and imprisonment. To encourage compliance, section 66P of the Amendment PDPO provides for an immunity to a person who complies with a cessation notice against any civil liability to another person only because of that compliance.

Pursuant to section 66N of the Amendment PDPO, persons affected by the cessation notice can lodge an appeal to the Administrative Appeal Board within 14 days after the date on which a cessation notice is served, but they must comply with the requirements set out in the cessation notice pending appeal.

Implications

Under the Amendment PDPO, overseas technology providers, for example social media platform operators, online search engine operators and internet service providers that provide service in Hong Kong may be subject to a cessation notice if the Commissioner reasonably believes they are able to take steps as required therein. Such situation potentially arises if these global providers have no presence, but a branch office in Hong Kong to receive the cessation notice.

Upon receiving a cessation notice, the local staff are faced with a difficult choice, because very often they do not have control over the doxxing acts committed on their social media platforms hosted or managed overseas, thus are not able to take down the alleged doxxing contents. In any event, if the Hong Kong employees fail to remove the content in question, they could nevertheless be subject to criminal liabilities under the Amendment PDPO. Although section 66P is in place to encourage one to comply with a cessation notice, the extraterritoriality of the Amendment PDPO is still expected to give rise to issues of compliance with the notice.

Takeaway

With the amendments to the PDPO being implemented, members of the public are best advised to exercise extra care and prudence when using the internet when retrieving, collating, consolidating, reporting and reposting information online. Individuals and businesses should continue to keep an eye on the updates in the legislative developments.

Global or local technology providers should also be alert to the liability arising from the Amendment PDPO and formulate internal protocols, procedures and training programs to ensure that employees located in Hong Kong are well-equipped with the required knowledge to deal with cessation notice, requests for production of documents, searches and seizures of materials, etc. issued by the Commissioner.

Further, it is important to note that compliance with cessation notice is essential because under section 101E of the Criminal Procedure Ordinance (Cap. 221), if the person who commits the offence is a corporation, any director or officer of the corporation whose consent or connivance contributed to the commission of the offence, commits the same offence. Hence, it is possible for personal liability to attach to the management of a company where he or she fails to procure the company or its staff to comply with a cessation notice.