Skip to content

Media Statements

Media Statement - PCPDs Updates on Doxxing and Cyberbullying

Date: 21 October 2019

PCPD’s Updates on Doxxing and Cyberbullying


The office of the Privacy Commissioner for Personal Data (PCPD) today gave the following updates on the latest situation of doxxing and cyberbullying and PCPD’s follow-up actions:

Overall Situation
  • The PCPD received the first doxxing and cyberbullying case on 14 June. As at noon 21 October 2019, the PCPD received and proactively found 2,683 related cases, in which 13 online social platforms and discussion forums, and 2,145 web links were involved. 
  • A total of five people have been arrested by the Police on suspicion of contravening section 64 (offences for disclosing personal data obtained without consent from data users) of Personal Data (Privacy) Ordinance (PDPO), including an earlier case where prosecution was made by the Police on 25 September 2019. In that prosecution case, a man who was suspected to have improperly disclosed personal data of other individuals on the Internet was charged with “conspiracy to disclosing personal data obtained without consent from data users” (a crime which is related to section 64 of PDPO), and “access to computer with dishonest intent”.
PCPD’s Follow-up Actions
  • As at noon 21 October, the PCPD has written to the related 13 platforms 84 times to urge them to remove a total of 1,632 web links and to post warnings that netizens who engage in doxxing and cyberbullying may commit a serious offence under section 64 of PDPO.  Among those web links, 612 web links (representing about 37%) have already been removed. For those links that have not been removed, the PCPD would continue to urge the related platforms to remove them and would continue to monitor the platforms.
  • Most of the 13 platforms involved do not operate from or are not registered in Hong Kong. Among the platforms involved, two are registered in Hong Kong. The PCPD has conducted investigations of both platforms in accordance with PDPO.  The most active platform operates outside Hong Kong. In order to protect the victims from harm as soon as possible, the PCPD has for 20 times strictly urged that platform to remove more than 1,000 links, but more than 900 links are still on that platform. The PCPD has contacted the relevant overseas government agency stationed in Hong Kong for assistance and will continue to work with the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) earnestly to yield results.
  • In the case of a doxxing website that appeared earlier, the PCPD has requested the HKCERT to contact the corresponding authorities for follow-up actions. The PCPD noted that the website that once appeared under seven domain names are now no longer in operation.
  • The PCPD has also urged all the platforms concerned to provide registration information or IP addresses of the netizens who uploaded the relevant doxxing posts. However, all the platforms (including the above-mentioned platform with the most serious doxxing activities) have not responded to the PCPD.
  • If those platforms still do not provide information to the PCPD, the PCPD will consider further actions (including summons) in an attempt to get from the platforms registration information or IP addresses of the netizens who uploaded the doxxing posts, to facilitate the PCPD’s investigation.
  • As individuals’ (including children’s) personal data were disclosed for the unlawful purposes of bullying, incitement and intimidation, and consent of the persons concerned was not obtained, it is certainly unfair and illegal, and causing the data subjects to suffer from psychological harm. Hence, after preliminary investigation, the PCPD considers that persons engaging in such acts may have contravened section 64 of PDPO, the PCPD would refer the cases to the Police for further investigation.
  • As at noon 21 October, the PCPD has referred 1,297 cases of this nature to the Police for further criminal investigation and for consideration for prosecution.
  • The consequences of contravention of section 64 of PDPO are serious. The maximum penalty is a fine of HK$1,000,000 and imprisonment for 5 years. 
Legal Consequences and Assistance
  • The PCPD emphasises that under the law, the parties involved not only may have committed criminal offences, but they may also face civil claims by those affected persons suffering from psychological harm.
  • Affected persons are entitled to claim compensation from the persons involved in respect of the damage caused by doxxing. The PCPD may, pursuant to section 66B of PDPO, grant legal assistance to the aggrieved individuals who intend to institute legal proceedings to seek compensation.
Making Complaints to the PCPD
  • Victims of doxxing or cyberbullying are advised to take the following actions:
  1. Make a complaint to the PCPD (Email: complaints@pcpd.org.hk
    Address: Room 1303, 13/F, 248 Queen’s Road East, Wan Chai, Hong Kong);
  2. Request the social media platform or website to remove the doxxing or  cyberbullying contents;
  3. Review the privacy setting of social media accounts to restrict access to or distribution of the content for better privacy protection.
Personal Data on the Register of Electors
Meanwhile, there have been once again discussions in the community about the issue of restricting disclosure of the names and addresses of voters in the Register of Electors to curb doxxing. In July 2015, the PCPD published a report entitled “Survey of Public Registers Maintained by Government and Public Bodies”. The survey examined 10 commonly used public registers, including the Register of Electors. The PCPD has sent the report to the relevant Government bureaux, departments and agencies, providing a number of recommendations on how to improve the protection of personal data privacy in the registers. The PCPD will be pleased to discuss again with the Government and provide advice.

PCPD's Repeated Explanations of the Serious Criminal Liabilities of Doxxing 
  • The PCPD has frequently explained to the public over the past few months the serious criminal liabilities potentially incurred by doxxing. Since 1 June 2019:
    • The PCPD has issued 24 related media statements (with the first one being issued on 14 June);
    • The PCPD has given more than 30 responses to media enquiries;
    • All the responses to the media are uploaded to the PCPD's website;  
    • The Privacy Commissioner has explained to the media or the general public for more than 45 times (e.g.: 《政經星期六》on Commercial Radio on 29 June and 31 August, 《自由風自由Phone》on RTHK Radio 1 on 28 August,《千禧年代》on RTHK Radio 1 and 《在晴朗的一天出發》on Commercial Radio on 29 August, “Hong Kong Today” on RTHK Radio 3 on 23 July,《香樹輝King  King傾》 on Metro Finance on 6 September, 《大鳴大放》 on Now TV on 8 September, 《時事大破解》on Phoenix TV Hong Kong Station on 20 September,  feature story on 《東周刊》on 25 September, and feature story on 《信報財經月刊》 in October 2019, etc) ;
    • The relevant guidance and educational information on the legislation has been posted on social media platforms such as Facebook and YouTube;
    • More than 900 relevant reports on the Internet, electronic and traditional media.
-End-