On 6 October 2022, just before the first anniversary of the commencement of the Personal Data (Privacy) (Amendment) Ordinance 2021 (the Amendment Ordinance) introducing the anti-doxxing regime, a doxxer was convicted of seven charges of “disclosing personal data without consent”, contrary to section 64(3A) of the Personal Data (Privacy) Ordinance (Cap. 486) (the Ordinance). The doxxer disclosed his ex-girlfriend’s personal data, including her name, photos, residential address, private and office telephone numbers, and the name of her employer and her position, on four social media platforms without her consent after a brief relationship. The doxxer was subsequently sentenced to 8 months’ imprisonment on 15 December 2022. This was the first sentencing case under the new anti-doxxing regime which took effect on 8 October 2021.
The above case is just the tip of the iceberg. As the use of social media continues to grow by leaps and bounds, social media platforms have unfortunately become a convenient place for doxxing activities which, as the Honourable Coleman J put it, “have created a state of affairs in society which endangers the lives, safety, health, property or comfort of the public as a whole.” To combat doxxing activities which are intrusive to personal data privacy, my Office, the Office of the Privacy Commissioner for Personal Data (the PCPD), has been sparing no effort in enhancing public awareness and taking enforcement actions against such illegal acts. As the anti-doxxing regime has been in effect for slightly more than a year at the time of writing, I would like to recapitulate in this article the key features of the Amendment Ordinance and highlight the enforcement work of my Office over the past year.
The Two-Tier Structure
The Amendment Ordinance introduces new doxxing offences under a two-tier structure:
New Criminal Investigation and Prosecution Powers
Unlike the pre-amendment period when the Privacy Commissioner was criticised for being a “toothless tiger”, the Privacy Commissioner under the Amendment Ordinance is empowered to conduct criminal investigations into doxxing-related offences and institute prosecutions. To this end, my Office has set up a new Criminal Investigation Division composed of former members of the Hong Kong Police Force and staff redeployed from other divisions. The new division is well supported by the Complaints Division and the Legal Division of my Office in its investigative work. The new criminal investigation powers include the power to require materials and assistance by issuing a written notice, power to apply for a warrant from the Court to search premises and access electronic devices, power to access electronic devices without a court warrant under urgent circumstances where it is not reasonably practicable to obtain such warrant, and the power to stop, search and arrest.
Depending on the gravity of the cases, prosecution may be instituted in my name for summary offences in the Magistrates’ Court, while cases involving the commission of indictable offences or other criminal offences will be referred to the Police for further investigation and consideration of prosecution.
These new powers have enabled my Office to handle doxxing cases from the start of criminal investigations to collection of evidence and instituting prosecution actions. The streamlined process effectively expedites enforcement actions against doxxing cases. It is noteworthy, for instance, that we successfully secured the first conviction in October 2022, less than four months after the suspect was arrested in June this year.
Since the Amendment Ordinance came into effect in October 2021, up to 30 November 2022 my Office had received a total of 740 complaints relating to doxxing offences and initiated 109 criminal investigations. On 13 December 2021, my Office made the first arrest for a suspected doxxing offence of “disclosing personal data without consent” under section 64(3A) of the Ordinance. As of 30 November 2022, a total of 10 arrests for suspected doxxing offences had been made. The Police had also arrested 5 persons (including 1 arrested in a joint operation with my Office) for suspected contravention of doxxing offences concerning “the disclosure of personal data without consent which causes specified harm to the data subject or any of his/her family members” under section 64(3C) of the Ordinance.
Among the arrests, charges were laid against the arrested persons in 3 cases. As mentioned at the beginning of this article, the first sentencing was handed down in December 2022. Meanwhile, the defendant in another doxxing case was convicted in December. The case was adjourned to January 2023 for sentence, pending acquisition of relevant reports.
Cessation Notice
Apart from bringing perpetrators of doxxing activities to justice through criminal investigations and prosecutions, it is paramount that doxxing messages are removed promptly to prevent doing further harm to the victims. The Amendment Ordinance also confers statutory powers on the Privacy Commissioner to serve cessation notices to demand the removal of doxxing messages.
Given the borderless nature of the internet, an extra-territorial provision is introduced in such a way that a cessation notice may be served regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a person in Hong Kong (including an internet service provider having a place of business in Hong Kong), or, in relation to an electronic message, a service provider outside Hong Kong (which covers the overseas operators of social media platforms) that is able to take a cessation action.
Since the commencement of the Amendment Ordinance up till 30 November 2022, my Office issued more than 1,400 cessation notices to 24 online platforms, requesting them to remove over 16,500 doxxing messages. The overall compliance rate on the removal of doxxing messages is over 90%, notwithstanding that most of the cessation notices were served on operators of online platforms in operation overseas.
Promotion, Publicity and Public Education
As the old saying goes, “an ounce of prevention is worth a pound of cure”. Enhancing public awareness and promoting compliance with the Amendment Ordinance through promotion, publicity and education remain top priorities of my Office, with a view to nipping doxxing activities in the bud. In this regard, my Office issued the “Personal Data Privacy (Amendment) Ordinance 2021 Implementation Guidelines” in October 2021 to provide guidance for the public on the scope of doxxing offences and my powers under the Amendment Ordinance.
Furthermore, my Office also launched a series of publicity and education campaigns, including broadcasting short videos, television and radio announcements, and distributing promotional leaflets and posters. A dedicated webpage on doxxing offences was also launched on our website. As of 30 November 2022, my Office had conducted 29 webinars/seminars on the anti-doxxing regime, which were attended by over 3,800 participants.
External Collaborations
On the external front, my Office has joined hands with other local regulatory authorities to ramp up our enforcement efforts. Memoranda of Understanding were signed between my Office and the Police, and between my Office and the Department of Justice, to foster mutual cooperation and collaboration in criminal investigations and prosecutions. With enhanced statutory powers, in particular the extra-territorial power to serve cessation notices to request the removal of doxxing messages, I also strove to foster collaboration with data protection authorities of other jurisdictions. The PCPD has taken up the co-chairmanship of the International Enforcement Cooperation Working Group, known as IEWG, of the Global Privacy Assembly since October 2021, with a view to enhancing its strategic role in international enforcement initiatives and priorities, and reinforcing international cooperation with other data protection authorities.
Concluding Remarks
One year on, the new anti-doxxing regime has begun to bear fruits. The new regime serves to safeguard the values of our city as a civilized society and uphold the rule of law across the territory. I take pride in reiterating that the implementation of the new regime over the past year did not affect the normal and lawful business activities in Hong Kong, nor the freedom of speech and free flow of information that Hong Kong citizens enjoy.