The recent social unrests have given rise to certain unprecedented challenges to our society, one of which is "doxxing". Doxxing involves non-consensual disclosure of an individual’s personal information for the purposes of harassment or intimidation, thus causing or likely to cause psychological or bodily harm to the victims and/or physical damage to their properties. At one time during the past few months, we saw the intensification of social and political conflicts, and doxxing activities surge dramatically to an alarming level. The victims of these doxxing cases come from all walks of life, including government officials, public figures, police officers, teachers and students.
Under the current legislative framework, doxxing may constitute a contravention of section 64(2) of the Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO") (i.e. disclosure of personal data of a data subject obtained from a data user without the data user’s consent and causing psychological harm to the data subject), which is a criminal offence punishable by a fine of up to HK$1 million and imprisonment for 5 years. Besides, doxxing and cyberbullying activities may also involve other offences such as criminal intimidation.
Doxxing does not merely harm the individuals concerned. It is a classic example of weaponization of personal data and may destroy the very social fabrics of our society if not curbed. As so well said by the Justices of Appeal in Junior Police Officers’ Association of the Hong Kong Police Force v Electoral Affairs Commission and others [2019] HKCA 1197, "If doxxing practices are not curtailed, the fire of distrust, fear and hatred ignited by them will soon consume the public confidence in the law and order of the community, leading to disintegration of our society."
The Privacy Commissioner for Personal Data (PCPD) has been fighting an uphill battle in curbing the cases of doxxing in Hong Kong. Not to mention the limited powers conferred on the PCPD, the proliferated use of social media platforms has contributed to the prevalence of doxxing cases. It might not be an exaggeration to say that social media has provided a very convenient platform for the doxxers to disseminate the doxxing posts. More often than not, the platforms took down the posts only out of their own pleasure and did not provide information of the culprits. There are two main difficulties in the enforcement actions. First, many online platforms were registered overseas, and thus are not covered by the PDPO. Second, social media platforms do not require registration of account users with their real names. This means that doxxing can be performed anonymously and the identity of the offenders, doxxers, cannot be revealed.
The High Court has recently granted an interim injunction order in Secretary for Justice v Persons unlawfully and wilfully conducting themselves in any of the acts prohibited under paragraph 1(a) and (b) in the indorsement of claim [2019] HKCFI 2809 to prevent the abuse of internet-based platform for wilful dissemination of information for the purpose of encouraging the use or threat of violence intended or likely to cause bodily injury or damage to properties. In the judgement of Hon Coleman J dated 15 November 2019, it is stated that there is abundant evidence demonstrating the significant role of social media platforms in intensifying violence. In discussing the social and moral responsibility of social media, Hon Coleman J also cited that obiter by the Court of Final Appeal in Oriental Press Group Ltd v Fevaworks Solutions Ltd (2013) 16 HKCFAR 366, noting that "a platform provider must genuinely recognise and take all reasonable steps to protect the rights and reputations of persons from being unlawfully damaged by postings published on the forum…while an Internet intermediary may not be expected to police or filter the many-to-many discussions hosted, it is appropriate to require prompt action to take down the offending postings upon receiving a complaint or otherwise becoming aware of them."
As the proliferation of the use of social media and the rapid spread of hate speech and other socially undesirable information have become a common concern around the world, many overseas jurisdictions have established different regulatory frameworks in response.
In New Zealand, the Harmful Digital Communications Act 2015 criminalise the acts of a person who posted offending materials containing the personal data of another person with an intention of causing harm to a victim. The victims may apply to courts for an order against the defendant or the social media platform to take down the harmful materials and to disclose the identity of the author. Non-compliance with the court order is an offence, punishable by fine and imprisonment.
In Singapore, a bill to amend the Protection from Harassment Act was introduced into the Parliament in April 2019 proposing that doxxing and cyberbullying be included as criminal offences punishable by fine and/or imprisonment. A new Protection from Harassment Court will be set up to provide relief to victims, who can apply for a protection order to stop the doxxers or any third party from publishing the offending communications.
In the international arena on data privacy, around 120 data protection authorities have adopted a resolution on social media and violent extremist content online at the 41st International Conference of Data Protection and Privacy Commissioners (which is now renamed to Global Privacy Assembly). As social media has become much more pervasive, the resolution urges social media providers to protect their services from being misused and to stop the dissemination of violent extremist content without compromising the freedom of expression. Cross border frameworks for collaborations between data protection authorities to take down such violent contents are also needed in a timely manner, as well as the ability to investigate and enforce offences such as doxxing through the development of a bilateral or multilateral assistance mechanism.