Date: 15 December 2022
First Sentencing Case of the New Doxxing Offence
The Shatin Magistrates’ Court earlier on 6 October 2022 convicted a 27-year old male, Mr HO Muk-wah, of seven charges of the new doxxing offence upon his guilty plea. After considering the relevant reports, the court today (15 December 2022) sentenced the defendant to 8 months’ imprisonment. The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling, welcomed the court’s ruling.
The Privacy Commissioner said, “members of the public should resolve their disputes by lawful means. Doxxing is not a means to resolve disputes and it would only escalate conflict. Moreover, doxxing is a serious offence and offender is liable on conviction to immediate imprisonment terms, with the maximum penalty being a fine up to $1,000,000 and imprisonment for 5 years.”
Background of the case
The defendant and the victim had a short relationship before breaking up. Between 19 and 26 October 2021, the defendant disclosed on four social media platforms the personal data of the victim without her consent, including her name, photos, residential address, private and office telephone numbers, name of her employer and her position. The defendant also impersonated the victim to open accounts on three of the said platforms. The defendant stated in the relevant messages that the victim welcomed others to visit her at her residential address. Many strangers later contacted the victim and tried to get acquainted with her.
The PCPD arrested the defendant on 22 June 2022. Upon legal advice of the Department of Justice, a total of seven charges were laid against the defendant on 17 August 2022 in respect of doxxing offences. The defendant pleaded guilty to all charges at the Shatin Magistrates’ Court and was convicted by the Court on 6 October 2022 on his disclosure of the personal data of the victim on four social media platforms between 19 and 26 October 2021 without her consent, with an intent to cause specified harm to her or her family members, or being reckless as to whether specified harm would be (or would likely be) caused to her or her family members, in contravention of section 64(3A) of the Personal Data (Privacy) Ordinance (PDPO).
Relevant provisions under the PDPO
Pursuant to section 64(3A) of the PDPO, a person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject—
(a) with an intent to cause any specified harm to the data subject or any family member of the data subject; or
(b) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject.
A person who commits an offence under section 64(3A) is liable on conviction to a fine of $100,000 and imprisonment for 2 years.
According to section 64(6) of the PDPO, specified harm in relation to a person means—
(a) harassment, molestation, pestering, threat or intimidation to the person;
(b) bodily harm or psychological harm to the person;
(c) harm causing the person reasonably to be concerned for the person’s safety or well-being; or
(d) damage to the property of the person.
－End－