Date: 4 September 2019
Privacy Commissioner Responds to Media Enquiries regarding
Disclosure of Personal Data for Doxxing Purposes on Websites or
Instant Messaging Platforms Registered Outside Hong Kong
In response to recent media enquiries on whether netizens’ disclosure of others’ personal data for doxxing purposes on websites or instant messaging platforms registered outside Hong Kong is subject to the provisions of the Personal Data (Privacy) Ordinance (PDPO) and the follow-up actions taken by the office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD), the Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Mr Stephen Kai-yi WONG, has made the following response:
Relevant requirements of the Ordinance
PDPO’s main target of regulation is the data users who “control” the collection, holding, processing or use of personal data. As long as the personal data is controlled from or within Hong Kong, the related “data users” are regulated under the PDPO, regardless of whether or not the websites or instant messaging platforms are registered in Hong Kong and whether or not their registrants are located outside Hong Kong. For cases that involve online platforms registered outside Hong Kong, it naturally would be more complicated in collecting evidence and enforcing the law, e.g. it may take a longer time to investigate.
If those account holders (as data users) who uploaded the personal data for “doxxing” purposes are able to control the collection, holding, processing or use (including disclose and transfer) of personal data in Hong Kong, they must comply with the relevant provisions of PDPO and the six data protection principles, in particular:-
-
Personal data must be collected in a lawful and fair way;
-
Personal data obtained even from the public domain can only be used for a purpose for which the data was collected or for a directly related purpose, unless voluntary and explicit consent is obtained from the data subject;
-
Disclosure of personal data obtained without consent resulting in psychological harm to the data subject, regardless of intent, is a criminal offence.
PCPD’s follow-up actions
The PCPD has received complaints related to personal data being disclosed on websites or instant messaging platforms registered outside Hong Kong, and also examined and follow-uped on those suspected doxxing cases that were found via proactive web searching.
In the face of doxxing acts, the statutory power conferred on the PCPD under the relevant provisions of the PDPO is actually limited. In order to effectively deter those wrongful acts, the PCPD needs additional powers, including criminal investigation and prosecution powers, power to apply for a warrant from the Court to search and seize records and documents, as well as the extension of the scope of the legal assistance scheme to assist parties who have suffered psychological harm from doxxing to apply to the Court for an injunction, etc.
Nevertheless, since the first related cyberbullying complaint was received by the PCPD on 14 June, the doxxing activities have become prevalent, with the number of cases ever increasing. The PCPD has hence written to nine related online platform operators since 28 June, requesting them to remove all inappropriate posts. We recorded the first removal of such post on 30 June. The PCPD has also set up a special team since 24 July to search for links with inappropriate posts. As of noon 4 September, the PCPD has written 45 times to the related online platforms, requesting them to remove a total of 1,058 web links, of which 479 (representing 45%) have already been removed. The PCPD will continue to request the related platforms to remove the inappropriate contents and will continue reviewing those platforms.
The PCPD is gravely concerned about the harm caused by doxxing and cyberbullying towards the individual victims and society at large. The PCPD has been working closely with the Police, including timely referring cases which may have contravened the criminal provision of the PDPO to the Police for criminal investigations and considering for prosecutions. From 14 June to noon 4 September, the PCPD received, proactively found and examined 1,057 related cases, and has referred 692 cases to the Police for investigation.
The PCPD has also frequently explained to the public the serious criminal liabilities potentially incurred by doxxing. Since 1 June 2019:
-
The PCPD has issued 11 related media statements (with the first one issued on 14 June);
-
The PCPD has given 26 responses to media enquiries;
-
All the media responses have been uploaded on website: PCPD.org.hk
-
The Privacy Commissioner has explained to the media or the public for more than 45 times (e.g.: 《政經星期六》on Commercial Radio on 31 August and 29 June, 《自由風自由Phone》on RTHK Radio on 28 Aug,《千禧年代》on RTHK Radio and 《在晴朗的一天出發》on Commercial Radio on 29 August, “Hong Kong Today” on RTHK Radio 3 on 23 July, etc) ;
-
The relevant guidance and educational information on the legislation has been posted on social media platforms such as Facebook and YouTube.
-
More than 680 relevant reports on the Internet, electronic and traditional media.
The Privacy Commissioner reiterates that the PCPD has, as always, enforced the law in a fair and just manner under PDPO.
Links of the media statements:
－End－