Skip to content

The Personal Data (Privacy) Amendment Ordinance 2021

The Personal Data (Privacy) Amendment Ordinance 2021

Following the passing of the Personal Data (Privacy) (Amendment) Bill 2021 (the Amendment Bill) on 29 September 2021, the amended provisions of the PDPO targeted on doxxing take effect on 8 October 2021.

Please click here for the Personal Data (Privacy) Amendment Ordinance 2021. 

Please click here for the media statement issued by the Government on 8 October 2021.

Please click here for the media statement issued by the PCPD on 8 October 2021. 
 

Major aspects of the amendments

  1. Create offences to curb doxxing acts
    • To reflect the severity of doxxing cases, two new offences under a two-tier structure are introduced:
      • The first tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Any person who commits the first tier doxxing offence is liable on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years.
      • The second tier offence is an indictable offence for disclosing any personal data of a data subject without the relevant consent of the data subject; the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and the disclosure causes any specified harm to the data subject or any family member of the data subject. Any person who commits the second tier doxxing offence is liable on conviction on indictment to a fine of HK$1,000,000 and to imprisonment for 5 years.
    • The new offences offer protection not only to data subjects, but also to their family members.
  2. Empower the Commissioner to carry out criminal investigation and institute prosecution
    • To step up enforcement against the doxxing offences, the Commissioner is empowered under the new provisions to carry out criminal investigation into offences under the section 64 of the PDPO as well as its related offences, and institute prosecution in the Commissioner’s own name for summary offences in the Magistrates’ Courts. Depending on the severity of the cases, the Commissioner will examine whether to institute prosecution in the Commissioner’s own name, or refer all the indictable offences, or cases involving commission of other offences to the Police for follow up and the Department of Justice for instituting prosecution.
    • The Commissioner is empowered with the following powers of investigation and arrest:
      • request the provisions of relevant documents, information or things (material) from any person, or require any person to provide the relevant materials and answer relevant questions to facilitate an investigation into doxxing and its related offences (including offences under the section 64 of the PDPO)
      • apply for a warrant to enter and search a premises, seize, remove and detain any material for the purpose of a specified investigation.
      • apply for a warrant to access, seize and detain an electronic device (such as a mobile phone) and decrypt material stored therein.
      • in urgent circumstance where it is not reasonably practicable to obtain warrant, the Commissioner may, without warrant, access an electronic device.
      • stop, search and arrest a person without warrant, if the person is reasonably suspected to have committed a doxxing or its related offences (including offences under section 64 of the PDPO )
  3. Confer on the Commissioner statutory powers to demand the cessation of doxxing contents
    • With the advancement of technology, doxxing contents can be spread and reposted in a click. To remove doxxing contents in an expeditious manner, in relation to a message, whether in written or electronic form, including but not limited to those posted on online platforms, a cessation notice may be served if the Commissioner has reasonable grounds to believe that:
      • the personal data in question was disclosed without the relevant consent of the data subject;
      • the person disclosing the personal data had an intent to or was being reckless as to the whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject;
      • when the disclosure was made, the data subject was a Hong Kong resident; or was present in Hong Kong; and
      • a Hong Kong person is able to take a cessation action (whether in Hong Kong) in relation to the message.
    • An extra-territorial effect is introduced such that a cessation notice may be served by the Commissioner regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a Hong Kong person (e.g. an individual in Hong Kong and an internet service provider having a place of business in Hong Kong) or, in relation to an electronic message, a non-Hong Kong service provider (e.g operators of overseas social media platforms).
    • A cessation notice will specify the date on or before which the cessation action must be taken. If a person who receives the cessation notice contravenes the notice, that person commits an offence unless the person can raise a reasonable excuse with sufficient evidence to establish a defence.
    • An appeal may be made to the Administrative Appeals Board (“AAB”) against a cessation notice by any person who is affected by the notice within 14 days after the date on which a cessation notice is served. However, the appeal process does not affect the operation of the cessation notice and therefore any person who receives a cessation notice must still comply with its requirements within the timeframe specified therein pending the AAB’s decision. Depending on the circumstances, the Commissioner may, where appropriate, cancel a cessation notice by serving a written notice.
    • Besides, as there have been doxxing acts targeting specific persons or groups in the society, the Commissioner is empowered under the new provision to apply to the Court for an injunction to prevent the future recurrence of doxxing incidents targeted at specific persons or groups.

Background of legislation

  • The Government submitted the Legislative Council (LegCo) Brief on the Amendment Bill to the LegCo on 14 July 2021, and gazetted the Amendment Bill on 16 July 2021.
  • The Amendment Bill aims to combat doxxing acts that are intrusive to personal data privacy, through the criminalisation of doxxing acts, and conferring on the Commissioner statutory powers to issue cessation notices demanding the cessation or restriction of disclosure of doxxing contents. The Amendment Bill also confers on the Commissioner power to conduct criminal investigation and institute prosecution for doxxing cases, so as to step up enforcement against doxxing cases.
    • Please click here for the Amendment Bill.
    • Please click here for the media statement issued by the Government.
    • Please click here for the paper submitted to the LegCo by the Government.
       
  • The Amendment Bill was introduced into the LegCo for first and second reading on 21 July 2021.
    • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
       
  • Secretary for Constitutional and Mainland Affairs and the Privacy Commissioner attended the first meeting of the Bills Committee on Personal Data (Privacy) (Amendment) Bill 2021 on 6 August 2021.
    • Please click here for the opening remarks by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
    • Please click here for the relevant papers of the meeting.
  • The resumption of the Second Reading debate and Third Reading of the Amendment Bill took place at the Legislative Council (LegCo) on 29 September 2021, and the Amendment Bill was passed by the LegCo.
    • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the resumption of the Second Reading debate on the Amendment Bill (in Chinese only).
    • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the Committee Stage Amendments of the legislative process (in Chinese only).
    • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs in adopting the report by the Legislative Council (in Chinese only).
    • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the setting down of the Third Reading of the Amendment Bill (in Chinese only).