Media Statements

PCPD Responds to Doxxing of Staff of a Media Organisation and
Other Individuals and Posting of Their Personal Data in Public Places

In response to recent media enquiries about websites suspected of disclosing personal data of staff of Apple Daily and other individuals, and the posting of their personal data in public places, the office of the Privacy Commissioner for Personal Data (PCPD) has made the following response:

Websites Suspected of Disclosing Personal Data:

• It was noted that the doxxing website in question had ceased operation.
• For the newly emerged doxxing websites, as their servers are not located in Hong Kong and Personal Data (Privacy) Ordinance (PDPO) does not contain any express provision for extra-territorial jurisdiction, the PCPD has no statutory power to order the relevant overseas organisations (including the companies that assigned the domain names and the companies that host the servers) to disclose the website operators’ information.
• If the proposed amendments to PDPO are accepted, the PCPD can:
  1. apply to the court for an injunction when necessary to require the relevant social media platforms or websites to remove and stop uploading doxxing contents/posts;
  2. directly undertake criminal investigations and lodge prosecutions for cases involving criminal offences; and
  3. impose administrative fines, when appropriate, directly on offenders to enhance deterrence and protection of personal data privacy.
• The PCPD has timely followed up on the present case of the newly emerged websites, on the longstanding principles of being just and fair, and impartial, by requesting the websites to remove and stop uploading all posts involving doxxing or illegal act. The PCPD has requested the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) to contact the corresponding authorities for follow-up actions. The PCPD will keep on monitoring the situation. In the same way as the other cases of doxxing and cyberbullying have been handled, since the present case has obviously contravened section 64 of PDPO (offences for disclosing personal data obtained without consent from data users), the PCPD immediately referred the case to the Police for criminal investigations, including investigation of the website operators, and consideration for prosecution.
• The Apple Daily has obtained an Interim Injunction Order (the Order), which restrains persons from disclosing and disseminating personal data of its staff. But the emergence of the abovementioned websites showed that the Order has been violated. It is absolutely inappropriate to disclose others’ personal data arbitrarily on the Internet and the PCPD condemns such act. As the PCPD has no jurisdiction over the Order of the Court, the PCPD cannot enforce the Order or investigate the violation of the Order. However, the PCPD has taken the aforesaid follow-up actions immediately, hoping that the doxxing acts of those websites can be stopped.
• The updated figures on cases of doxxing and cyberbullying are as follows:
  
  Number of cases related to online disclosure of personal data received and proactively found by the PCPD:
  • The PCPD received the first doxxing case on 14 June. As at noon 3 October 2019, the PCPD received and proactively found 1,720 related cases, in which 11 online social platforms and discussion forums, and 1,957 web links were involved.
  • The PCPD urged the related platforms 70 times to remove a total of 1,605 web links, of which 542 web links (representing about 34%) have already been removed. For those links that have not been removed, the PCPD would continue to urge the related platforms to remove them and would continue to monitor the platforms.
  • The PCPD has also urged the relevant online platforms to provide registration information and IP data of netizens concerned.
  • After preliminary investigation, if the PCPD considers the persons involved may have contravened the criminal offences under section 64 of PDPO, the PCPD would refer the cases to the Police for further investigation.  As at 3 October, the PCPD has referred 1,204 cases to the Police for further criminal investigation and for consideration for prosecution.
• It was noted that against the background of the prevalent infringement of personal data privacy, doxxing and cyberbullying in recent months, the Police lodged prosecution for the first time of a man on 25 September in connection with the offences relating to section 64 of PDPO. With regard to the man who is suspected to have improperly disclosed personal data of other individuals on the Internet, the Police charged the man with “conspiracy to disclosing personal data obtained without consent from data users” (a crime which is related to section 64 of PDPO), and “access to computer with dishonest intent”.
• Contravention of section 64 of PDPO may attract a maximum fine of HK$1,000,000 and imprisonment for 5 years.

• Any person disclosing (e.g. publicly displaying) others’ personal data, no matter whether the data was obtained from public domain, must consider whether the means of collection and use is legal and fair. If personal data is collected and disclosed for the unlawful purposes of bullying, incitement and intimidation, it is certainly illegal and unfair, and it contravenes the Data Protection Principles or requirements of PDPO, as well as other relevant laws.
• After preliminary investigation, the PCPD considers that persons engaging in such acts may have contravened section 64 of PDPO.
• The PCPD reiterates that everyone must respect others’ personal data privacy. Similar doxxing and cyberbullying acts may incur other civil and criminal liabilities.
• Any person who suspects that his personal data privacy has been infringed and can provide prima facie evidence (including the contact details of the wrongdoer and how the personal data has been misused) may complain to the PCPD. Upon receipt of the complaint, the PCPD will handle and follow up the case according to PDPO and its Complaints Handling Policy with strict confidence.