The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Mr Stephen Kai-yi WONG noted that security personnel discharging their duties at a recent meeting of the House Committee of the Legislative Council (LegCo) had been doxxed on social media platforms. Apart from disclosing personal data of the security personnel and their family members, some netizens indicated or even incited that harm be inflicted on their spouses and children. The Privacy Commissioner strongly condemns such “despicable online weaponisation of personal data”, which exposes victims, particularly those performing duties, to pressure and fear.
The office of the Privacy Commissioner for Personal Data (PCPD) has discovered such doxxing postings during online patrol and will initiate an investigation. The Privacy Commissioner urges the doxxers to stop immediately and will write to urge the social media platforms concerned to take down the posts without delay.
In the light of the current borderless flow and transfer of personal data, the Privacy Commissioner joined other members during the 41st International Conference of Data Protection and Privacy Commissioners (now renamed the Global Privacy Assembly) in Tirana, Albania last year to co-sponsor a resolution on combating violence, hatred and extremist content on social media and on internet. The resolution was passed by the conference.
The Privacy Commissioner stresses that doxxing activities of this kind not only amount to a criminal offence under the Personal Data (Privacy) Ordinance (PDPO), they also violate data ethics adopted in many other places. It is a total disregard for personal and public interest. It is definitely illegal and is totally unacceptable in our society. Section 64(2) of PDPO provides that a person commits an offence if the person discloses any personal data of a data subject without the consent of a data user who controls or is in possession of that personal data (such as public domain), in particular those innocent (including the spouse and children of a doxxing victim), and if the disclosure causes psychological harm to the data subject, most of which being caused by intimidation. Upon conviction, the maximum penalty is a fine of HK$1,000,000 and an imprisonment for 5 years
In addition, the High Court granted an interim injunction order (HCA 2007/2019) restraining persons from wilfully disseminating any material or information on any internet-based platform or medium for the purpose of promoting, encouraging or inciting the use or threat of violence, intended or likely to cause bodily injury to any person or damage to any property unlawfully within Hong Kong. The order also restrains persons from assisting, causing, counselling, procuring, instigating, inciting, aiding, abetting or authorising others to commit any the aforesaid acts. The PCPD will refer cases of suspected violations of the interim injunction order to the Department of Justice for follow-up action(s).