Date: 5 July 2021
Response to media enquiry on the proposed amendments to the PDPO
Thank you for your enquiry. Our response to your enquiry is as follows:
Enquiry
“I am familiar with the content of the letter and understand that it expressed the AIC's and its members' concerns about the proposed doxxing-related amendments to the Personal Data Privacy Ordinance (PDPO).
Do you or your office have any comment about the letter, or response to the concerns raised by the AIC? Have you responded to the AIC's request for a virtual meeting, or discussed the issues with the group? Is there any updated information on when the bill will be submitted?”
Answer:
-
The Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD) has received the letter from the Asia Internet Coalition (AIC) expressing their views on the proposed amendments to the Personal Data (Privacy) Ordinance (PDPO) to combat doxxing (the Amendments).
-
Doxxing activities which became rampant in Hong Kong since mid-2019 has tested the limits of morality and the law. Doxxing acts, which are intrusive to personal data privacy and involve the weaponisation of personal data, have caused great harm to the victims and their family members and the society at large in recent years. In a typical doxxing case, the more common personal data which are disclosed include the name, photograph, Hong Kong identity card number, date of birth, occupation, phone number, and/or the address of the victim and, in some cases, their family members. Very often, the victims find themselves exposed to intimidation calls, cyberbullying or identity thefts and the effect of doxxing on the victims can be, as found by the court in a doxxing case, severe and long-lasting.
-
The Hong Kong SAR Government and the PCPD have spared no efforts in combating doxxing. Between June 2019 and May 2021, the PCPD handled over 5,700 doxxing-related cases. Out of the 5,700 cases, over 1,400 cases which involved possible contravention of section 64(2)[1] of the PDPO were referred to the Police for criminal investigation and consideration of prosecution. Moreover, between June 2019 and May 2021, the PCPD referred 63 cases which involved suspected breach of the court’s injunction orders to the Department of Justice for follow up actions.
-
To enhance the PCPD’s capability to combat doxxing, the Hong Kong SAR Government has proposed legislative amendments to the PDPO to criminalize doxxing acts as an offence and confer criminal investigation and prosecution powers on the Privacy Commissioner for Personal Data. The Government’s aim is to complete the drafting of the Amendments and introduce the Amendment Bill for the scrutiny of the Legislative Council within this legislative session.
-
According to a survey commissioned by the PCPD last year, about two-thirds of the general public and organisations surveyed expressed their support for curbing doxxing through giving the PCPD the following powers:-
-
The power to require removal of contents relating to doxxing from social media platforms and websites (71% for individual respondents and 64% for institutional respondents, respectively);
-
The power to carry out criminal investigation (70% and 63% respectively); and
-
The power to institute prosecution (69% and 61% respectively).
-
The Amendments will not have any bearing on free speech, which is enshrined under Article 27 of the Basic Law of the Hong Kong SAR and the Hong Kong Bill of Rights Ordinance. In addition, Part 8 of the PDPO, which provides for the exemptions from the provisions of the PDPO under specified circumstances, covering areas such as crime prevention or detection (section 58), health (Section 59), news activity (Section 61), statistics and research (Section 62), etc. will not be affected by the Amendments.
-
The PCPD reiterates that the Amendments only concern unlawful doxxing acts and the PCPD’s related enforcement powers. The scope of the doxxing offence will be clearly set out in the Amendments. The PCPD strongly rebuts any suggestion that the Amendments may in any way affect foreign investment in Hong Kong. The PCPD welcomes views from stakeholders on the Amendments and will meet with the representatives of the AIC shortly to better understand their views.
[1] Section 64(2) of the PD(P)O provides that a person commits an offence if (a) the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent; and (b) the disclosure causes psychological harm to the data subject.