Date: 14 August 2019
Privacy Commissioner responds to media reports
on open letter issued by purported PCPD staff
It was recently reported that some staff of the office of the Privacy Commissioner for Personal Data (PCPD) have anonymously issued a joint letter to the public to express views on recent social incidents. The Privacy Commissioner for Personal Data (Privacy Commissioner) made the following statement and clarifications:
Open letter
The letter has enclosed photos showing the backside of the PCPD staff cards, a PCPD staff name card without revealing the personal details of the purported PCPD staff, and the PCPD logo in letterheads. The PCPD stamp and logo on some of these photos are old designs which have been replaced. Against this background, the PCPD is unable to ascertain the authenticity of the photos and the representativeness of the letter.
PCPD’s impartial handling of cyberbullying and “doxxing” cases
In response to the recent acts of cyberbullying and infringement of personal data privacy, the PCPD has, as always, enforced the law in a fair and just manner under the Personal Data (Privacy) Ordinance (the Ordinance), regardless of the political orientation and identity of the affected parties, and followed up on every single case impartially.
The PCPD received the first doxxing-related cases of this nature on 14 June. As at noon 13 August, the PCPD received and proactively found 634 related cases (557 complaint cases, 77 enquiry cases).
In fact, not all of the affected parties in the cases handled by the PCPD are police officers. Other individuals such as ordinary citizens are also involved. The follow-ups and enforcement work of all 557 complaint cases have always been consistent. The related figures are as follows:
-
In 402 cases (72%), the affected parties are police officers;
-
In 155 cases (28%), the affected parties are not police officers.
The PCPD has taken the initiative to contact the operators of the relevant online social media platforms or discussion forums to request them, and to ask the netizens through them to immediately delete and stop uploading those bullying or even illegal posts/contents. Though the PCPD does not have statutory power to immediately direct the operators to delete such posts/contents, they have to perform their statutory and corporate ethical duties. Some of the operators have been cooperative by taking remedial actions within a short period of time.
As at 13 August, seven online social media platforms and discussion forums, and 815 web links were involved. The PCPD has requested the related platforms to remove a total of 780 web links, of which 422 web links (representing more than half) have already been removed. For those links that have not been removed, the PCPD would continue to urge the concerned platforms to remove them and the PCPD would continue to monitor the platforms.
Of the 422 removed links, 332 (79%) involved police officers, and 90 (21%) involved people other than police officers.
Strict and fair enforcement
The present incident involved the disclosure of individuals’ (including children’s) personal data. Not only was one’s privacy being intruded, but it could also lead to identity theft. The involved links also suggested illegal purposes like bullying, incitement and intimidation, and even affecting innocent third parties unrelated to the incidents. Such disclosure is definitely without the consent of the individuals concerned, and is definitely unfair and illegal, causing psychological harm to the parties involved. After preliminary investigation, the PCPD considers that the persons involved may contravene section 64 of the Ordinance, which is a criminal offence.
Given such blatant breach of the laws, it would be unacceptable and utterly erroneous to question the enforcement actions taken by the PCPD simply on the ground that there has been no precedent, or there are ulterior motives.
Handling complaints on a case-by-case basis under the law
The letter mentioned that the PCPD has deviated from its usual way of complaint handling in relation to the cyberbullying cases. The PCPD has to stress that this is not true. First, the PCPD has followed up on the complaint cases in relation to cyberbullying, such as proactively contacting the operators of the relevant online social media platforms or discussion forums to request them and to ask the netizens through them to delete those posts/contents. This is not a new approach. It was also adopted in the past cyberbullying cases. Second, most of the past cases were different from the extensive doxxing this time around owing to the following reasons:
-
The personal data was used for “domestic purposes” under section 52 of the Ordinance, i.e. it concerned only with the management of personal, family or household affairs;
-
Some cases involved disclosure of another one’s private matters after a relationship break-up, and in such a case the data user and the data subject at least knew each other; and
-
The criminal elements of large-scale indiscriminate attack, incitement or intimidation were not involved, so there was no legal basis for referring the cases to the Police for criminal investigation.
Special team, fair enforcement
Setting up a special team is a timely and appropriate measure, in the wake of the unprecedented situation currently. The bullying cases received in the past were isolated cases and the number was small. However, in the present doxxing incident, the victims are numerous, doxxing has become prevalent, and it involves incitement and intimidation, all of which were absent in the past. There is an actual need for the PCPD to set up a special team for timely and effective enforcement.
The PCPD has not taken an entirely different approach in handling the cases. Even if this office, as an objective and independent regulatory body, had adopted somewhat different measures, they would have been necessary and proportionate in response to the actual circumstances and severity of the issue. Strictly or blindly following the conventional ways of doing things is tantamount to ignoring the reality and failing to directly address the issue, resulting in failure to resolve the issue in a timely manner.
Timely and appropriate measures
When illegal actions have become prevalent, the PCPD, as a responsible regulatory body, is duty bound to adopt more stringent measures in its follow-up and enforcement actions. This duty is not only performed under the power conferred upon by Personal Data (Privacy) Ordinance (PDPO), but also in line with the spirit of sentencing principles imposed by the Court. For instance, section 27 of the Organised and Serious Crimes Ordinance (Cap. 455) provides that, in making a sentencing order in respect of specified offences, the Court may take into consideration admissible evidence concerning the prevalence of the offence and impose a more severe sentence (see HKSAR v Ma Suet Chun & Others [2001] 4 HKC 337). It is therefore proportionate to set up a special team to deal with the doxxing cases, having taken into account the prevalence of the contravening acts. The PCPD should never refrain from adopting appropriate and necessary measures to cope with the current situation merely on the grounds that there has been no precedent. The PCPD is duty bound to ensure its regulatory actions are not overly rigid or ineffective. Recent incidents have further revealed that PDPO is lagging behind practical needs of the situation. The PCPD is in the process of comprehensively reviewing PDPO, with a view to keeping the law up to date and endeavouring to protect personal data privacy.
Concluding remarks
Even if some of the details of the social incidents as described in the open letter were true, no one, regardless of whether they are members of the public or any one with public duties, should request the enforcement agency to enforce or not to enforce the law pertaining to the identity or occupation of the people affected by bullying simply on the ground of differences in political background or orientation. We believe that the anonymity and lack of personal information of those who signed the letter was for the purpose of protecting their own privacy from being infringed upon or preventing doxxing. How could one expect the PCPD not to take follow-up actions on cyberbullying cases of the others?
Just as all the people in Hong Kong, the PCPD staff are entitled to legitimately enjoy the human rights and freedoms, including the freedom of opinion and expression. However, when performing duties, they should be impartial to avoid actual and perceived conflicts between their public duties and personal stances.
The Privacy Commissioner Mr Stephen Kai-yi WONG would like to once again thank all the colleagues for upholding the principle of political neutrality and serving the public in a dedicated and professional manner. Public officers should be dedicated; be committed to the rule of law, objectivity and impartiality; and at all times ensure that their behaviour would not impede their performance of official duties in a fair and professional manner. These values are what the public expects of them, too.
－End－