Earlier on, security personnels discharging their duties at a meeting of the House Committee of the Legislative Council (LegCo) and their family members were doxxed on social media platforms. The Privacy Commissioner for Personal Data, Hong Kong (PCPD), Mr Stephen Kai-yi WONG, has initiated online patrol and investigation, and received complaints. As at 5:00 pm on 22 May 2020, seven LegCo security personnels who had been doxxed on eight web links complained to the PCPD. In tandem with the investigations, the PCPD has urged the doxxers to stop the criminal acts immediately and written to ask three social media platforms concerned to take down the postings without delay. As at 5:00 pm on 22 May 2020, three of those web links were taken down. As the investigation of the cases is ongoing, the PCPD would not comment on individual cases at this stage.
Of the doxxing cases above, some have been referred to the Police for follow-up after preliminary investigation by the PCPD, and the others are still under investigation. Bound by the secrecy provisions of the Personal Data (Privacy) Ordinance (PDPO), the PCPD will not comment on or provide details of the cases. Irrespective of the identity or background of the persons involved, the PCPD will exhaust its powers conferred by the PDPO to follow up on the cases. The PCPD will take further action in accordance with the law if doxxing or “criminal doxxing” involving intimidation is found.
The PCPD noted that at a press conference held on 25 May 2020 by the Hong Kong Institute of Registered Security Trainers relating to the doxxing of security personnels, LegCo Member Dr the Hon Priscilla LEUNG Mei-fun suggested that the PCPD rendered assistance to the security personnels concerned. He stressed that section 64(2) of the PDPO (commonly known as the “criminal doxxing” provision) provides that a person commits an offence if the person discloses any personal data of a data subject which was obtained from a data user without his or her consent (including data obtained from the public domain), and the disclosure causes psychological harm to the data subject (i.e. the person being doxxed). Upon conviction, the doxxer is liable to a maximum penalty of HK$1,000,000 and an imprisonment for 5 years. As the PCPD does not have criminal investigation and prosecution powers, the PCPD, having exhausted his investigation powers conferred by the PDPO, could only refer those cases involving elements of “criminal doxxing” to the Police for criminal investigation and to the Department of Justice for consideration of prosecution.
While the PCPD is not vested with criminal investigation and prosecution powers, the PCPD has followed up on all doxxing cases with the limited powers conferred by the PDPO and has yielded results. Follow-up actions include writing to the online platforms concerned urging the removal of the web links, and referring cases of suspected violations of court injunction orders to the Department of Justice for follow-up actions. Since the first doxxing and cyberbullying case was received on 14 June 2019, as at 5:00 pm 22 May 2020, the PCPD had written 187 times to 17 online platforms concerned, urging them to remove a total of 3,088 illegal web links. 1,820 web links (59%) had already been removed. The PCPD has also urged the online platforms to post warnings that netizens who engage in doxxing and cyberbullying may commit a criminal offence under section 64 of the PDPO. After preliminary investigations, the PCPD has referred 1,411 suspected cases of contravention of section 64 of the PDPO to the Police for further criminal investigation and prosecution, and also referred 44 cases involving suspected violations of the injunction orders to the Department of Justice for follow-up actions.
Section 66 of the PDPO provides that an individual who suffers damage by reason of a data user’s contravention of a requirement under the PDPO as determined by the Privacy Commissioner may be entitled to compensation from that data user for the damage. Besides, the PCPD, in consideration of all the circumstances of a case, may grant legal assistance to the aggrieved individual he deems appropriate pursuant to section 66B of the PDPO, including providing legal advice and considering whether there are sufficient grounds to assist the aggrieved individual(s) to institute proceedings to seek compensation. During the period from 1 January 2020 to 22 May 2020, the PCPD approved two applications for legal assistance.
In addition, although the PCPD does not have the relevant legal locus standi to initiate legal proceedings, he has referred cases of suspected violations of the interim injunction order (HCA 2007/2019) relating to doxxing acts to the Department of Justice for follow-up actions.
The PCPD stressed that he has exhausted all the powers conferred upon him by the law to deal with doxxing cases. As Dr the Hon Priscilla Leung Mei-fun rightly pointed out, the powers of the PCPD should be strengthened to combat doxxing acts more effectively. For instance, the PCPD should be given the power to conduct criminal investigations and prosecutions, direct the relevant social media platforms or websites to remove doxxing content, impose administrative fines, etc. These suggestions are in line with the direction of the legislative amendments advocated by the PCPD.