Skip to content

Response to Media Enquiry or Report

Response to Media Enquiry or Report

Date: 30 November 2019

Response to media enquiry on Hong Kong doxxing cases

Thank you very much for your follow-up question. Please find below our response:

  • There have been media reports that personal data of Hong Kong’s top officials and lawmakers including the Chief Executive and the Secretary for Justice of Hong Kong SAR were disclosed. As the Privacy Commissioner for Personal Data, Hong Kong (PCPD) is currently investigating the relevant cases, we have to decline to comment on individual cases. Nevertheless, the PCPD can outline how these cases are handled generally.
  • Investigation will commence upon receipt of complaints from affected persons or when the PCPD out of its own initiative finds there are prima facie cases.
  • Upon investigation, if the PCPD finds there is sufficient evidence to suggest a breach of the Data Protection Principles under the Personal Data (Privacy) Ordinance (PDPO) by disclosing or using without consent a person’s personal data for a purpose other than that for which the person data was collected, an enforcement notice, demanding the contravening party to take remedial actions, will be issued.
  • On the other hand, if an individual’s personal data had been obtained from public sources and was used or disclosed for the unlawful purposes of bullying, incitement and intimidation, and consent of the sources concerned had not been obtained, causing the individual to suffer from psychological harm, persons engaging in such acts may have contravened a criminal offence under section 64 (2) of PDPO (i.e. “Offences for disclosing personal data obtained without consent from data users”). The consequences of this criminal offence (doxxing) are serious. The maximum penalty is a fine of US$130,000 and imprisonment for 5 years.
  • In both cases as mentioned in the two bullet points above, the contravening party or offender will have to be identified. Also, the PCPD will take action to secure remedial steps be taken without delay by urging the contravening party or offender (if identified), to remove and stop posting the contravening messages, and where applicable the social platforms on which the personal data was used or disclosed online to:
    a) provide details of the offenders;
    b) warn the offenders not to post similar messages; and
    c) discharge the social responsibility of a social platform in ensuring no violence or criminal acts or verbals are being promoted through the platforms, without compromising the freedom of speech.
  • For all cases, the PCPD enforces the laws independently and fairly, having no regard whatsoever to the victims’ background, status or political stance.
  • For all cases, if there is sufficient evidence to suggest that the contraventions are justifiable, for example, where the statutory exemptions or defence of prevention and detection of crimes apply, the cases will be determined accordingly. For cases that merit further investigation before proceeding to prosecution or trial, they will be referred to the Police for criminal investigation.
  • The PCPD received the first criminal doxxing or cyberbullying case under section 64 (2) on 14 June. As of noon 29 November 2019, the PCPD has received and discovered 4,680 related cases, in which 4,303 cases were complaints and discovered by the PCPD, while 377 cases were enquiries. Totally 16 online social platforms and discussion forums, and 2,855 web links were involved.
  • The victims of doxxing are from all sorts of backgrounds and all walks of life. Of those 4,303 complaints and cases received and discovered, 4% (180 cases) were related to public officials including Government officers (other than police officers), and 36% (1,549 cases) were related to police officers and their families, 60% (2,574 cases) were related to other people, such as children, students, teachers, protestors, and unclassified people.
  • As of noon 29 November, the PCPD has written to the related 15 platforms 132 times to urge them to remove a total of 2,130 web links and to post warnings that netizens who engage in doxxing and cyberbullying may commit a serious offence under section 64 (2) of PDPO, of which 1,649 web links (representing about 77%) have already been removed.
  • As of noon 29 November, the PCPD has issued one summons to require a social platform to provide, among other things, the registration information and IP addresses of the netizens who had uploaded the offending messages, for the purposes of the PCPD’s investigation.