Hong Kong Today - RTHK's morning news programme Presenter: Hugh Chiverton
Doxxing cases multiply amid unprecedented unrest Privacy Commissioner Stephen Wong says personal data is being used as a weapon by the public against those with opposing views. The privacy watchdog received a record 9,100 complaints last year amid the anti-government protests, nearly four times more than in 2019. Almost half of them had to do with doxxing. On Boxing Day, a policeman held a reporters' ID card on his live-streaming camera, and that case alone resulted in some 2,500 complaints. Hugh Chiverton asked Wong if there’s anything the privacy watchdog can do about doxxing:
[Transcript]
Hugh: Good morning to you.
PC: Good morning Hugh.
Hugh: Thank you very much for joining this today. Is there anything very mighty the Privacy Commissioner can do about doxxing?
PC: Yes, we hope to be able to revise the current legislation with a view to giving the Privacy Commissioner more power and independent prosecution power included. As you would agree, personal data has been collected and used for legitimate purposes including commercial purposes and sometimes used as a shield or refuge for not providing personal data.
But recently we could see that there is a significant or alarming prevalence and [large] scale of doxxing activities happening in Hong Kong where in the past activities of this sort were little more than bullying among friends or persons personally known to one another, for purposes of venting their resentment or emotions.
But recently we could see that doxxing cases involved disclosure of personal data with some serious and blatant intimidation or incitement which cause psychological harm to persons being doxxed. So this is a situation that we have to look into seriously and we spare no efforts in combating activities of this kind.
Hugh: But you have to change the law to have that effect?
PC: Yes, currently we do lack sufficient or adequate power, you know, to curb activities of this kind mainly because of our provisions of our regulatory provisions. We don’t have adequate or sufficient scope to catch all those activities or doxxers. And we don’t have power to track them down either.
Hugh: Where do people get this information? It is private information which they are making public, which is the essence of doxxing. How do they get hold of it?
PC: Either because they know the person being doxxed, or this is the majority of the cases, that they obtain personal information data from public places, from public registers of the Government, from public social platforms etc.
(02:32)
Hugh: Okay, could you tighten up on that? I mean, say changing the law or other things you can do to lock down that kind of information?
PC: Yes, we hope. The difficulty is that it is really difficult, or if at all possible, to locate or identify the doxxers and this is the number one challenge that we have to tackle. The other one is that we can’t compel the social platforms to stop posting or stop carrying those postings on their platforms. So this is something that we need to look into too.
(03:16)
Hugh: Okay, given that there’s a problem if you did change the law to make this an offence, how would you fine the people responsible….you still have the same problem, wouldn’t you?
PC: We hope to be able to revise the law to the effect that we can compel the platforms to provide personal details of the doxxers. And also we can compel the platforms to remove the offending postings upon our request. And also we would like to ask them to regulate the activities online even outside Hong Kong, for those operators operating in other jurisdictions.
(04:02) Hugh: Is doxxing anything more than an embarrassment for people? Has anything come with the doxxing cases on it?
PC: Embarrassment is one thing, the other thing is they do suffer from psychological harm, and they do feel worried about the consequences of being doxxed. They do have some concern about the intimidating messages posted especially about their family members and children.
(04:33) Hugh: Some more than a quarter of the complaints referred to the case on Boxing Day where a policeman held the reporter’s ID card to his live-streaming camera. What can you do about that?
PC: There are two ways of looking at this issue. One is the use of personal data, the other one is whether it caused doxxing elements. The first way is we have to find out who the users are. For example if somebody said personal data has been obtained, and this person being the data user has to comply with those requirements under the Ordinance from the collection to the use of the data. If it violates the requirements of our Ordinance especially the Data Protection Principles, and then we will…
Hugh: I am sorry, you lost me there. You’re requiring the journalist who had his ID card shown to comply or something?
PC: If details of the ID card are being obtained by a person, this person after obtaining the personal data, he will have to comply with the requirements, when he uses the personal data collected, the purpose must be the same. If the purpose is not the same, the consent of the person involved must be obtained.
(06:14) Hugh: Okay, the second point you are making?
PC: The second point is that if it involves, like you know most doxxing cases nowadays, when personal data is used to attack another person, based on the information collected, adding intimating messages, including threats, incitement to commit other crime or offending activities, this is a criminal case. This is a criminal offence regulated under our Ordinance too.
Hugh: You saying this isn’t doxxing?
PC: No. Sometimes we have to look into the issues depending on the facts of each case.