Media Statements

Privacy Commissioner Responds to Doxxing of Staff of a Media Organisation and Other Individuals

In response to recent media enquiries about a website disclosing personal data of staff of Apple Daily and other individuals, and follow-up actions taken by the office of the Privacy Commissioner for Personal Data (PCPD), the Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Mr Stephen Kai-yi WONG, has made the following response:

• The domain name of the doxxing website in questionwas registered outside Hong Kong (i.e. Russia) and its server is not located in Hong Kong. As the Personal Data (Privacy) Ordinance (PDPO) lacks extra-territorial jurisdiction, the PCPD has no statutory power to order the relevant overseas organisations (including the company that assigned the domain name and the company that hosts the server) to disclose the website operator’s information.
• The Privacy Commissioner has timely followed up on the present case (87 individuals involved) on the longstanding principles of being just and fair, and impartial by requesting the website to remove and stop uploading all posts involving doxxing or illegal act, and liaising with the privacy enforcement authority in the relevant jurisdiction for itsassistance and follow-up. In the same way as the other cases of doxxing and cyberbullying have been handled, since the present case has obviously contravened section 64 of the PDPO (offences for disclosing personal data obtained without consent from data users), the PCPD immediately referred the case to the Police for criminal investigations, including investigation of the website operator, and consideration for prosecution.
• To timely and effectively stop the doxxing acts on social media platforms or websites, the PCPD, in future, should be vested with enhanced statutory power, e.g. extra-territorial jurisdiction.
• Victims of doxxing are recommended to take the following actions:
  1. Make a complaint to the PCPD (Email: complaints@pcpd.org.hk
     Address: Room 1303, 13/F, 248 Queen’s Road East, Wan Chai, Hong Kong)
  2. Request the social media platform or website to remove the doxxing contents;
  3. Review the privacy setting of social media accounts to restrict access to or distribution of the content for better privacy protection.