Date: 23 December 2022
Privacy Commissioner’s Office Laid Charge in a Doxxing Case
The Office of the Privacy Commissioner for Personal Data (PCPD) today laid a charge against a Chinese male aged 31 (defendant) for “disclosing personal data without consent”, contrary to section 64(3A) of the Personal Data (Privacy) Ordinance (PDPO). The case will have its first mention hearing at the Fanling Magistrates’ Court in the morning of 5 January 2023. The defendant is presently on bail.
Background of the case
The investigation revealed that the defendant and the victim were former co-workers of a company. Their relationship turned sour because of performance at work, which ultimately led to the dismissal of the defendant by the company. Later in mid-October 2021, personal data of the victim, including his Chinese name, mobile phone number, name of his former residential estate, name of employer, along with information on the past deeds of the victim, were posted on a social media platform. The PCPD arrested the defendant on 2 September 2022.
Relevant provisions under the PDPO
Pursuant to section 64(3A) of the PDPO, a person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject—
(a) with an intent to cause any specified harm to the data subject or any family member of the data subject; or
(b) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject.
A person who commits an offence under section 64(3A) is liable on conviction to a fine of $100,000 and imprisonment for 2 years.
According to section 64(6) of the PDPO, specified harm in relation to a person means—
(a) harassment, molestation, pestering, threat or intimidation to the person;
(b) bodily harm or psychological harm to the person;
(c) harm causing the person reasonably to be concerned for the person’s safety or well-being; or
(d) damage to the property of the person.
－End－