Media Statements

Privacy Commissioner Provides Updates on Doxxing and Cyberbullying: Reiterating Criminal and Social Liability of Doxxers and Assisting Platforms

Since June this year, serious doxxing acts have taken place and personal data has been “weaponised”. The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Mr Stephen Kai-yi WONG provides the following updates on the latest situation of doxxing and the follow-up actions carried out by the office of the Privacy Commissioner for Personal Data (PCPD).

Doxxing by Weaponising Personal Data

• The Privacy Commissioner reiterated that “section 64(2) of PDPO provides that a person commits an offence if the person discloses, without the consent of a data user who controls or is in possession of any personal data of a data subject (such as public domain or platforms), especially the person who is innocent (including the spouse and children of a doxxing victim), and the disclosure causes psychological harm to the data subject, most of which came from intimidation. Upon conviction, the maximum penalty is a fine of HK$1,000,000 and an imprisonment for 5 years”
• The Privacy Commissioner also stated that online social platforms and discussion forums have legal and social responsibilities of not assisting or promoting any illegal acts of doxxing.
• In October this year, representatives from more than 120 data protection authorities around the globe attended the Global Privacy Assembly (formerly known as International Conference of Data Protection and Privacy Commissioners). In relation to social media and online violent extremist content, the Assembly urged social media service providers to offer service protection to protect their services from being misused and prevent the dissemination of those content online. This highlights that acts of intimidation or incitement such as doxxing on the Internet are not acceptable to the international community.
• The PCPD found that doxxing targets are individuals in the recent eye-catching incidents. Personal data of the individuals and their family members would be widely circulated at online platforms immediately.

Overall Situation

• The PCPD received the first doxxing and cyberbullying case on 14 June. As at noon 20 December 2019, the PCPD received and discovered 4,359 related cases. Totally 16 online social platforms and discussion forums, and 2,916 web links were involved.
• The victims of doxxing are from all sorts of backgrounds and all walks of life with various views, among which police officers and their family members are the single largest sector of people falling victim to doxxing. Of the 4,359 complaints and cases discovered in our patrol, 1,577 cases (36% of the total cases) involved police officers and their family members. There were 180 cases of doxxing on government officials and public servants (accounting for about 4% of the total cases). In addition to public servants, there are also members of the public (accounting for about 30% of the total cases) who have stated their support for the government or the Police and were doxxed.
• On the other hand, some citizens were doxxed after making online comments against the government or the Police (accounting for about 10% of the total cases). Some others were dissatisfied with the behaviour of protestors and disclosed their personal data online. Also, there are websites that encourage citizens to provide the identity of protestors for bringing them to justice (accounting for about 20% of the total cases).

PCPD’s Follow-up Actions

• The PCPD has referred 1,402 cases of this nature to the Police for criminal investigation and for consideration for prosecution.
• A total of five people have been arrested in four cases by the Police on suspicion of contravening section 64 of PDPO, including an earlier case where prosecution was made by the Police. In that prosecution case, a man was charged with “conspiracy to disclosing personal data obtained without consent from data users”.
• As at noon 20 December, the PCPD has written to the related 15 platforms 140 times, urging them to remove a total of 2,497 web links and to post warnings that netizens who engage in doxxing and cyberbullying may commit a serious offence under section 64 of PDPO. Among those web links, 1,677 web links (67%) have already been removed.
• The PCPD has sent a letter to remind relevant platforms or website operators that the High Court has granted an interim injunction order (HCA 1957/2019) to, inter alia, restrain persons from unlawfully and wilfully disclosing personal data of Police Officers and/or their family members, intended or likely to intimidate or harass Police Officers and/or their family members. The order also restrains persons in assisting, causing, counselling, procuring, instigating, inciting, aiding, abetting or authorising others to commit any of the aforesaid acts. Another interim injunction order (HCA 2007/2019) also restrains persons from willfully disseminating any material or information on any internet-based platform or medium for the purpose of promoting, encouraging or inciting the use or threat of violence, intended or likely to cause bodily injury to any person or damage to any property unlawfully within Hong Kong. The order also restrains persons from assisting, causing, counselling, procuring, instigating, inciting, aiding or abetting others to commit any the aforesaid acts. The PCPD reminded relevant platforms or website operators that they are obligated to carry out legal and ethical corporate responsibility. They should not encourage illegal and unethical behaviour against public interest to avoid platforms being abused as a tool for infringing the privacy of personal data. If the platform or website operators deliberately publish or do not delete the aforesaid prohibited posts, it may be regarded as violation of the injunction and contempt of court.
• After the interim injunction order came into effect, the PCPD received and found cases involving suspected violations of interim injunction order, and referred relevant cases to the Department of Justice for follow-up. As at noon 20 December 2019, 40 cases were referred.
• We will continue to spare no efforts in enforcing the law to curtail these harmful doxxing acts. Since some involved platforms are based overseas, the Privacy Commissioner has written to the relevant local data protection authorities seeking for international cooperation to combat the doxxing acts.