Media Statements

Privacy Commissioner Responds Again to Doxxing of Staff of a Media Organisation and Other Individuals

In response to recent media enquiries about a website disclosing personal data of staff of Apple Daily and other individuals, and follow-up actions taken by the office of the Privacy Commissioner for Personal Data (PCPD), the PCPD has made the following response:

• The domain name of the doxxing website in question was registered outside Hong Kong (i.e. Russia) and its server is not located in Hong Kong. As Personal Data (Privacy) Ordinance (PDPO) lacks extra-territorial jurisdiction, the PCPD has no statutory power to order the relevant overseas organisations (including the company that assigned the domain name and the company that hosts the server) to disclose the website operator’s information. To stop the doxxing acts on social media platforms or websites, the PCPD, in future, should be vested with enhanced statutory power, e.g. extra-territorial jurisdiction.
• The Privacy Commissioner has timely followed up on the present case on the longstanding principles of being just and fair, and impartial by requesting the website to remove and stop uploading all posts involving doxxing or illegal act, and liaising with the privacy enforcement authority in the relevant jurisdiction for its assistance and follow-up. The PCPD has requested the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) to contact the corresponding authorities for follow-up actions. The PCPD will keep on monitoring the situation. In the same way as the other cases of doxxing and cyberbullying have been handled, since the present case has obviously contravened section 64 of PDPO (offences for disclosing personal data obtained without consent from data users), the PCPD immediately referred the case to the Police for criminal investigations, including investigation of the website operator, and consideration for prosecution.
• The updated figures on cases of cyberbullying and doxxing are as follows:
  Number of cases related to online disclosure of personal data received and proactively found by the PCPD:
  • The PCPD received the first doxxing and cyberbullying case on 14 June. As at noon 27 September 2019, the PCPD received and proactively found 1,636 related cases, in which 10 online social platforms and discussion forums, and 1,916 web links were involved.
  • The PCPD urged the related platforms 56 times to remove a total of 1,421 web links, of which 541 web links (representing about 40%) have already been removed. For those links that have not been removed, the PCPD would continue to urge the related platforms to remove them and would continue to monitor the platforms.
  • The PCPD has also urged the relevant online platforms to provide registration information and IP data of netizens concerned.
  • After preliminary investigation, if the PCPD considers the persons involved may have contravened the criminal offences under section 64 of PDPO, the PCPD would refer the cases to the Police for further investigation.  As at 27 September, the PCPD has referred 952 cases to the Police for further criminal investigation and for consideration for prosecution.
• It was noted that against the background of the prevalent infringement of personal data privacy, doxxing and cyberbullying in recent months, the Police has made prosecution for the first time in connection with the offences relating to section 64 of PDPO. With regard to a man who is suspected to have improperly disclosed personal data of other individuals on the Internet, the Police charged the man with “conspiracy of disclosing personal data obtained without consent from data users” (a crime which is related to section 64 of PDPO), and “access to computer with dishonest intent” on 25 September.
• Contravention of section 64 of PDPO may attract a maximum fine of HK$1,000,000 and imprisonment for 5 years.