Date: 6 October 2022
First Conviction Secured for Doxxing Case
The Shatin Magistrates’ Court today (6 October 2022) convicted a 27-year old male, Mr HO Muk-wah, of seven charges relating to the new doxxing offence upon his guilty plea. Earlier in August this year the Office of the Privacy Commissioner for Personal Data (PCPD) laid seven charges of “disclosing personal data without consent”, contrary to section 64(3A) of the Personal Data (Privacy) Ordinance (PDPO), against Mr HO and Mr HO pleaded guilty today to the said seven charges relating to the disclosure of personal data of the complainant on four social media platforms between 19 and 26 October 2021. The defendant made the disclosures without the complainant’s consent, with an intent to cause specified harm to her or her family members, or being reckless as to whether specified harm would be, or would likely be, caused to her or her family members.
This is the first conviction under the new anti-doxxing regime which took effect on 8 October 2021.
Background of the case
The defendant and the complainant had a short relationship before breaking up. Between 19 and 26 October 2021, the defendant disclosed on four social media platforms the complainant’s personal data, including her name, photos, residential address, private and office telephone numbers, name of her employer and position. The defendant also impersonated the complainant to open accounts on three of the said platforms. The defendant stated in the relevant messages that the complainant welcomed others to visit her at her address. Many strangers later contacted the complainant and tried to get acquainted with her. The PCPD arrested the defendant on 22 June 2022. Upon legal advice obtained from the Department of Justice, a total of seven charges were laid against him on 17 August 2022 in respect of doxxing offence.
Today’s court proceedings
In today’s court hearing (6 October 2022) at the Shatin Magistrates’ Court, the defendant pleaded guilty to and was convicted of all seven charges. The court has adjourned the case to 15 December 2022 for sentence, pending the acquisition of relevant reports. The defendant was granted bail pending sentence.
Relevant provisions under the PDPO
Pursuant to section 64(3A) of the PDPO, a person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject—
(a) with an intent to cause any specified harm to the data subject or any family member of the data subject; or
(b) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject.
A person who commits an offence under section 64(3A) is liable on conviction to a fine of $100,000 and imprisonment for 2 years.
Pursuant to section 64(3C) of the PDPO, a person commits an offence if—
(a) the person discloses any personal data of a data subject without the relevant consent of the data subject—
(i) with an intent to cause any specified harm to the data subject or any family member of the data subject; or
(ii) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and
(b) the disclosure causes any specified harm to the data subject or any family member of the data subject.
A person who commits an offence under section 64(3C) is liable on conviction on indictment to a fine of $1,000,000 and imprisonment for 5 years.
According to section 64(6) of the PDPO, specified harm in relation to a person means—
(a) harassment, molestation, pestering, threat or intimidation to the person;
(b) bodily harm or psychological harm to the person;
(c) harm causing the person reasonably to be concerned for the person’s safety or well-being; or
(d) damage to the property of the person.
－End－