Media Statements

PCPD's Updates on Doxxing and Cyberbullying
Such Acts are Criminal Offences Subject to Fine or Imprisonment

The office of the Privacy Commissioner for Personal Data (PCPD) today gave the following updates on the latest situation of doxxing and cyberbullying:

• The PCPD received the first doxxing and cyberbullying case on 14 June. As at noon 30 September 2019, the PCPD received and proactively found 1650 related cases, in which 10 online social platforms and discussion forums, and 1928 web links were involved.
• As individuals' (including children's) personal data were disclosed for the unlawful purposes of bullying, incitement and intimidation, and consent of the persons concerned was not obtained, it is certainly unfair and illegal, and causing the data subjects to suffer from psychological harm. Hence, after preliminary investigation, the PCPD considers that persons engaging in such acts may have contravened section 64 (disclosing personal data obtained without consent from data users) of Personal Data Privacy Ordinance (PDPO).
• As at noon 30 September, the PCPD has referred 952 cases to the Police for further criminal investigation and for consideration for prosecution.
• Against the background of the prevalent infringement of personal data privacy, doxxing and cyberbullying in recent months, the Police lodged prosecution for the first time of a man on 25 September in connection with the offences relating to section 64 of PDPO. With regard to the man who is suspected to have improperly disclosed personal data of other individuals on the Internet, the Police charged the man with “conspiracy to disclosing personal data obtained without consent from data users” (a crime which is related to section 64 of PDPO), and “access to computer with dishonest intent”.
• The consequences of contravention of section 64 of PDPO are serious. The maximum penalty is a fine of HK$1,000,000 and imprisonment for 5 years.

• Over the past few months, once the PCPD received or proactively found posts with doxxing and cyberbully contents, the PCPD immediately liaised with the operators of the related websites, online social media platforms or discussion forums to urge them, and to ask the netizens through them to immediately delete and stop uploading those bullying or even illegal posts/contents.
• As at noon 30 September 2019, the PCPD has written to the related platforms 66 times to urge them to remove a total of 1421 web links, of which 541 web links (representing about 40%) have already been removed. For those links that have not been removed, the PCPD would continue to urge the related platforms to remove them and would continue to monitor the platforms.
• The PCPD has already urged the related platforms to post warnings that netizens who engage in doxxing and cyberbullying may commit a serious offence under section 64 of PDPO.
• The PCPD has also urged the operators of the relevant online platforms to provide registration information and IP data of netizens concerned, and repeatedly reminded netizens publicly and through media statements of the possible contravention of section 64 of PDPO, which is a criminal offence, and its maximum penalty.
• The PCPD has, as always, enforced the law in a fair and just manner under PDPO.

• The PCPD emphasises that under the law, the parties involved not only may have committed criminal offences, but they may also face civil claims by those affected persons suffering from psychological harm.
• Affected persons are entitled to claim compensation from the persons involved in respect of the damage caused by doxxing. The PCPD may, pursuant to section 66B of PDPO, grant legal assistance to the aggrieved individuals who intend to institute legal proceedings to seek compensation.

• If the proposed amendments to PDPO are accepted, the PCPD can:
  1. apply to the court for an injunction when necessary to require the relevant social media platforms or websites to remove and stop uploading doxxing contents/posts;
  2. directly undertake criminal investigations and lodge prosecutions for cases involving criminal offences; and
  3. impose administrative fines, when appropriate, directly on offenders to enhance deterrence and protection of personal data privacy.

• Victims of doxxing or cyberbullying are advised to take the following actions:
  1. Make a complaint to the PCPD (Email: complaints@pcpd.org.hk Address: Room 1303, 13/F, 248 Queen's Road East, Wan Chai, Hong Kong);
  2. Request the social media platform or website to remove the doxxing or cyberbullying contents;
  3. Review the privacy setting of social media accounts to restrict access to or distribution of the content for better privacy protection.

• The PCPD has frequently explained to the public over the past few months the serious criminal liabilities potentially incurred by doxxing. Since 1 June 2019:
  • The PCPD has issued 17 related media statements (with the first one being issued on 14 June);
  • The PCPD has given more than 30 responses to media enquiries;
  • All the responses to the media are uploaded to the PCPD's website;
  • The Privacy Commissioner has explained to the media or the general public for more than 45 times (e.g.: 《政經星期六》on Commercial Radio on 29 June and 31 August, 《自由風自由Phone》on RTHK Radio 1 on 28 August,《千禧年代》on RTHK Radio 1 and 《在晴朗的一天出發》on Commercial Radio on 29 August, “Hong Kong Today” on RTHK Radio 3 on 23 July,《香樹輝King King傾》 on Metro Finance on 6 September, 《大鳴大放》 on Now TV on 8 September, 《時事大破解》on Phoenix TV Hong Kong Station on 20 September, and feature story on 《東周刊》on 25 September, etc) ;
  • The relevant guidance and educational information on the legislation has been posted on social media platforms such as Facebook and YouTube;
  • More than 900 relevant reports on the Internet, electronic and traditional media.