A telecommunications technician who obtained the personal data of a family member of a police officer for doxxing by using his office computer was charged with, among others, an offence under section 64(2) of the Personal Data (Privacy) Ordinance (PDPO) which involved the disclosure of personal data obtained without the consent from relevant data users, thereby causing psychological harm to the family member of the police officer. The defendant, who was convicted at the District Court earlier on, was sentenced today (3 November) to imprisonment for 18 months. Together with other convictions, he was sentenced to imprisonment for 24 months. The Privacy Commissioner for Personal Data, Hong Kong (Privacy Commissioner), Ms Ada CHUNG Lai-ling welcomed the court ruling.
The Privacy Commissioner said, “It is saddening that doxxing acts often lead to cyberbullying or even criminal intimidation of the victims and their family members, which in turn causes continuous distress and serious psychological harm to the persons concerned. The cyber world is not beyond the law. Other than being morally wrong, doxxing acts may constitute criminal offence under the PDPO or other legislation. I urge members of the public not to flout the law and not to hurt others while harming themselves.”
The charge relating to the PDPO was that the defendant “disclosed personal data which was obtained from a data user without the data user’s consent, and the disclosure caused psychological harm to the data subject”, contrary to section 64(2) of the PDPO. In the present case, the defendant took advantage of his work in a telecommunications company to obtain the personal data including the Identity Card number, etc. of a family member of a police officer by using his office computer and disclosed the relevant data to a group on a social media platform for publication. This is the first doxxing case in which the defendant was convicted and sentenced to imprisonment for contravention of the relevant requirements since section 64(2) of the PDPO was amended in 2012.
Contravention of section 64(2) of PDPO bears serious consequences. On conviction, the maximum penalty is a fine of HK$1,000,000 and imprisonment for 5 years.
From June 2019 up to the end of October 2020, the Office of the Privacy Commissioner for Personal Data (PCPD) has written more than 200 times to request the operators of a total of 18 websites, online social media platforms or discussion forums concerned to remove more than 3,500 doxxing web links. If necessary, the PCPD will also seek the cooperation of the data protection authorities in different jurisdictions to combat doxxing. The PCPD will continue to monitor relevant platforms and pursue follow-up actions. The PCPD will spare no efforts in combating doxxing.
If the doxxing cases involve criminal elements, including possible contravention of section 64 of the PDPO, the PCPD will refer them to the Police for further investigation and consideration of prosecution. By the end of October 2020, the PCPD has referred over 1,400 cases to the Police for follow-up.
The PCPD understands that in relation to doxxing cases, the Police has arrested 13 persons for contravention of section 64 of the PDPO concerning the disclosure of personal data obtained without the consent from relevant data users.
Moreover, the High Court has granted three doxxing-related interim injunction orders[Note].On discovery of possible violations of the injunction orders, the PCPD will refer the cases to the Department of Justice for follow-up. As of the end of October 2020, the PCPD has referred 45 cases to the Department of Justice. In June and in mid-October, by violating the court’s interim injunction order, the defendants in two cases were convicted of contempt of court. Both defendants were sentenced to 28 days’ imprisonment, suspended for one year.