By Arthur Chan

Hong Kong, 12 December 2022: Hong Kong’s privacy watchdog has secured the first conviction under the city’s new anti-doxxing regime while also making arrests in nine other suspected cases. These are the first significant actions under the Personal Data (Privacy) (Amendment) Ordinance 2021, which came into effect on 8 October last year and empowers the Office of the Privacy Commissioner for Personal Data to carry out criminal investigations and initiate prosecutions.

Doxxing – the practice of maliciously leaking someone’s personal information so they may be targeted by others – has been increasingly prevalent since the 2019 social movement. While the new legislation appears to be chiefly aimed at protecting police, lawmakers and their respective families, the first case before the courts arose out of a domestic dispute. At Shatin Magistrates’ Court, a 27-year-old man admitted seven charges of “disclosing personal data without consent” contrary to section 64(3A) of the Personal Data (Privacy) Ordinance (Cap 486) (the “PDPO”).

The court heard the defendant and female complainant had a short relationship before breaking up. The man then disclosed her personal details – including name, photos, phone number and address – on four social media platforms. He also set up accounts in the complainant’s name and invited people to visit her, resulting in a number of strangers contacting her and making unwelcome advances. The defendant has been granted bail pending sentencing.

Pursuant to section 64(3A) of the PDPO, a person commits an offence if they disclose someone’s personal data without their consent:

1. with an intent to cause any specified harm to the victim or their family; or
2. being reckless as to whether any specified harm would be, or would likely be, caused to the victim or their family.

Under section 64(3C) of the PDPO, a person commits an offence if:

1. they disclose someone’s personal data without their consent:
   1. with an intent to cause any specified harm to the victim or any family member; or
   1. being reckless as to whether any specified harm would be, or would likely be, caused to the victim or any family member; and
2. the disclosure causes any specified harm to the victim or any family member.

A person who commits an offence under section 64(3A) can be fined up to HK$100,000 and imprisoned for a maximum of two years. Conviction under section 64(3C) carries a fine of up to HK$1 million and maximum jail term of five years.

According to section 64(6) of the PDPO, specified harm in relation to a person means:

1. harassment, molestation, pestering, threat or intimidation;
2. bodily harm or psychological harm to the person;
3. harm causing the person to be concerned for their safety or well-being; or
4. damage to their property.

In addition, the new legislation places obligations on managers of internet service providers or executives with the capability to remove online materials. The Privacy Commissioner can order them to take down doxxing information via a cessation notice, which may be served regardless of whether the disclosure is made in Hong Kong or not.

Such notice can be served on a Hong Kong person (for example, an individual in Hong Kong and an internet service provider having a place of business in Hong Kong) or, in relation to an electronic message, a non-Hong Kong service provider (for example, operators of overseas social media platforms). However, it remains to be seen how non-Hong Kong service providers can be compelled to provide any necessary information to the authorities for investigation purposes, let alone face charges.

In closing, it is worth noting that the Privacy Commissioner is making efforts to combat doxxing at source. An educational outreach programme under the theme “Stay Vigilant Online: Say ‘No’ to Cyberbullying” has been delivered, so far, to more than 8,000 students from 30 primary schools; talks and briefings are being held with the legal and business sectors; and anti-doxxing public information materials are being widely distributed.

But it is the enforcement actions  – multiple arrests and a landmark first conviction – which send a clear message to the public: Hong Kong’s new anti-doxxing legislation has teeth and is being robustly implemented.

Arthur Chan is a Senior Associate with BC&C. He deals with Criminal Matters while also covering Civil and Commercial Litigation and handles cases involving personal injury and employment issues. He can be contacted at Arthur@boasecohencollins.com.