What's On

 

I am sure that during the past four months, even when you are not in Hong Kong, you have seen from extensive media coverage the social incidents taking place in Hong Kong, including the unprecedented prevalence of doxxing and cyberbullying.

 

The number of cases received and found by me and my colleagues has increased by more than a hundred times, from just dozens of cases every year to 3,373 cases over a period of the last few months.  Just to give you an example of the doxxing cases,  a photograph of a police officer with his wife and his one-year-old son celebrating birthday, which was originally uploaded on a social media platform, was circulated in a chat group of an instant messaging platform, together with the intimidating remarks “pick up the kid from school with a hemp bag”. Other daily-life photographs and videos of the kid were also uploaded.  Inevitably, the parents worry about the personal safety of their son. As a father, I can understand how anxious and distressed the parents were.

 

That is why we say doxxing is practically weaponisation of personal data and can cause psychological harm to individuals.  How do we tackle it?  Doxxing actually involves disclosing personal data obtained without consent from the data user, and psychological harm being caused by the disclosure to the data subject. According to section 64 of Personal Data (Privacy) Ordinance (the Ordinance), the contravention may attract a maximum fine of HK$1,000,000 and imprisonment for 5 years. Of course, there are defences for the commission of the offence. For example, the person reasonably believed that the disclosure was necessary for the purpose of preventing or detecting crime; or the person disclosed the personal data for the purpose of a news activity and the publishing or broadcasting of the personal data was in the public interest.

 

While there are laws to enforce, it is a fact that “real-name registration” is not required on social media platforms.  Hence it is difficult to trace the identity of netizens who have committed doxxing. Nevertheless, my colleagues and I have exhausted all legal and possible means to stop such illegal behaviour. 

 

As at noon 29 October, I have written to the related 14 platforms 95 times to urge them to remove a total of 1,639 web links and to warn their netizens who engage in doxxing that they may commit a criminal offence.   I have also collaborated with the Hong Kong Computer Emergency Response Team Coordination Centre to track down a foreign doxxing website with the overseas regulatory authorities concerned.  We did succeed in terminating the operation of the website.   Unfortunately, it subsequently “came back to life” under other domain names.  In fact, most of the 14 platforms involved do not operate in or are not registered in Hong Kong.  One of the platforms contained over 1,000 illegal web links, representing 64% of the total number of web links, but only 127 web links (12%) have been removed as requested so far.  

 

Organisations outside our jurisdiction are beyond the remit of the Ordinance.  International collaboration has become more necessary than ever. Last week, at the International Conference of Data Protection and Privacy Commissioners, I joined forces with other privacy commissioners from all over the world to propose resolutions to tackle violent, hatred and extremist content on social media online. I also proposed to develop a mutual assistance mechanism with other jurisdictions in discharging the duty of cross-border protection of personal data privacy. Both proposed resolutions were passed in the conference. I also held meetings with senior representatives of multinational tech-giants, urging them to carry out social responsibilities, to meet public expectations and to follow data ethics governance. The responses from these tech-giants are encouraging.

 

Back in Hong Kong, the Secretary for Justice and the Commissioner of Police applied ‘ex parte’ to the court for an interlocutory injunction last Friday, prohibiting any members of the public from wilfully using or disclosing personal data of police officers and their family members, intended or likely to intimidate or harass them.  Restricted acts include doxxing. Assisting and abetting these acts is also contempt of court. I have been asked many times about my views on this issue. In terms of number of complaints received and cases found by my colleagues, 33% of the victims were police officers and their families, accounting for the largest single sector of the affected persons. Other victims were government officials, legislators, public figures, protestors, students, teachers, etc., while the remaining 1,738 victims with their identity or background unidentified. Although the number and proportion of cases involving police officers do not form the majority of the cases, some police officers might have reported their doxxing cases through other channels.  Figures apart, I believe that the difficulties faced by police officers in carrying out their duties, as well as the impact on public order were considered by the court in the ‘convenience balancing’ before granting the injunction. 

 

As you know, my major statutory function is to protect the personal data privacy right of a person. As always, I enforce the law in a fair and just manner, and follow up on every single case impartially, regardless of the victims’ occupation, identity, background and political views. Abiding by the law and equality before the law are two fundamental facets of the Rule of Law, which is also the expectation of the public and the cornerstone of Hong Kong's success.

 

Some jokingly say that as the Privacy Commissioner, I am merely a “toothless tiger”. In this doxxing saga, I hope the Ordinance can be strengthened and amended so as to give me “teeth”, such as the locus standi to apply for an injunction to the court, in order to curtail the harm caused to the victims as soon as possible; the power to directly issue prohibitive orders to require the relevant social media platforms or websites to remove and stop uploading “doxxing” contents and posts, and the power to require the relevant social media platforms to provide personal data (such as name, email address and IP address) of those having posted “doxxing” messages (i.e. the offenders) etc.

 

Bong Bong, we have also seen a lot of young people in the news footages, and I understand quite well their thoughts. However, as my old schoolmate would agree, violence has never been a lawful tool to demand any rights or freedoms under the established system in force.

 

Autumn is coming.  Keep warm.  I hope to be able to have a break from work and enjoy our time together at Christmas. 

 

Dad

 

2 November 2019