The new anti-doxxing regime introduced by Hong Kong's Personal Data (Privacy) (Amendment) Ordinance 2021 ('the Amendment Ordinance') has shown promising results in clamping down on illegal doxxing activities in Hong Kong in its first year of implementation. The new regime, which bears resemblance to similar laws in other jurisdictions, including Australia, Singapore, New Zealand, and California, came into effect in October 2021.
With a view to combatting doxxing activities which are intrusive to personal data privacy, the Office of the Privacy Commissioner for Personal Data ('PCPD') has been sparing no effort in enhancing public awareness and taking enforcement actions against such illegal acts under the new anti-doxxing regime. One year into implementation, Ada Chung Lai-Ling, Privacy Commissioner for Personal Data, Hong Kong, China, recapitulates the key features of the Amendment Ordinance and highlights the enforcement work of the PCPD over the past year.
The two-tier structure
The Amendment Ordinance introduces new doxxing offences under a two-tier structure:
New criminal investigation and prosecution powers
To effectively carry out enforcement actions against doxxers, the PCPD is empowered under the Amendment Ordinance to conduct criminal investigations into doxxing-related offences. New criminal investigation powers exercisable under the Amendment Ordinance include the power to require materials and assistance by issuing a written notice, power to apply for a warrant from the Court to search premises and access electronic devices, power to access electronic devices without a court warrant under urgent circumstances where it is not reasonably practicable to obtain such warrant, and the power to stop, search, and arrest.
Depending on the gravity of the cases, prosecution may be instituted in the Privacy Commissioner’s name for summary offences in the Magistrates' Court, while cases involving the commission of indictable offences or other criminal offences will be referred to the Hong Kong Police Force for further investigation and consideration of prosecution.
These new powers have enabled the PCPD to handle doxxing cases from the start of criminal investigations to the collection of evidence and instituting of prosecution actions. The streamlined process effectively expedites enforcement actions against doxxing cases. It is noteworthy, for instance, that the PCPD successfully secured the first conviction in relation to the new doxxing offences in October 2022, less than four months after the suspect was arrested in June 2022. In that case, a doxxer, who disclosed his ex-girlfriend's personal data, including her name, photos, residential address, private and office telephone numbers, and the name of her employer and her position, on four social media platforms without her consent after a brief relationship, was convicted of seven charges of the first-tier doxxing offence, namely, 'disclosing personal data without consent', and sentenced to eight months' imprisonment.
Since the Amendment Ordinance came into effect in October 2021, up to 31 December 2022, the PCPD received a total of 791 complaints relating to doxxing and initiated 114 criminal investigations. Since the first arrest made by the PCPD in December 2021, as of 31 December 2022, a total of 12 arrests for suspected doxxing offences had been made.
Cessation notice
Apart from bringing perpetrators of doxxing activities to justice through criminal investigations and prosecutions, it is paramount that doxxing messages are removed promptly to prevent further harm to the victims.
Given the borderless nature of the internet, the Amendment Ordinance confers on the PCPD statutory powers with extra-territorial effect to serve cessation notices to demand the removal of doxxing messages, regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a person in Hong Kong, or, in relation to an electronic message, a service provider outside Hong Kong that is able to take a cessation action.
Up to the end of 2022, the PCPD issued more than 1,500 cessation notices under the new regime to 26 online platforms, requesting the removal of over 17,000 doxxing messages. The overall compliance rate on the removal of doxxing messages is over 90%, notwithstanding that most of the cessation notices were served on operators of online platforms which were operated overseas.
Role of social media platforms
While the PCPD will continue to proactively monitor doxxing activities and issue cessation notices to online platforms wherever necessary, it is important to emphasise that operators of online platforms, especially social media platforms, have a responsibility to maintain a clean and safe online environment for their users. In this regard, it is observed that the privacy policy and terms of service of social media platforms commonly provide that users may not post unlawful and/or harmful contents, including those that infringe upon other's privacy, and that operators have in place policies to remove or restrict access to such contents, or even disable relevant users' accounts in cases of serious or repeated violation. In line with their privacy policies and terms of service, social media platform operators should bear responsibility in keeping an eye on the contents being posted on their platforms and taking prompt actions by themselves to remove any doxxing contents.
In addition, the use of social media platforms has become more prevalent among children nowadays, who may lack awareness about or ability in safeguarding their privacy. When compared to adults, children are more prone to over-sharing their personal data online without appreciating the associated risks involved, such as being subject to doxxing, cyberbullying, or even blackmail. Timely removal of doxxing contents involving children by platform operators is therefore pivotal to protecting the safety of minors in the online world. Other than imposing a minimum age requirement for users, platform operators should adopt an age-appropriate approach to ensure that they protect and respect children's privacy. This may include, for example, ensuring that the default setting for sharing personal data is as restrictive as possible, and providing reminders and warnings to young users in age-appropriate language.
Concluding remarks
It is pleasing to see that the new anti-doxxing regime has begun to bear fruits, and the PCPD can take pride that the implementation of the new regime over the past year did not affect the normal and lawful business activities in Hong Kong, nor the freedom of speech and free flow of information that Hong Kong citizens enjoy.
Ms Ada CHUNG Lai-ling, Privacy Commissioner for Personal Data