web.archive.org

Doxxing Offences

  • - The Personal Data (Privacy) Amendment Ordinance 2021

    - Following the passing of the Personal Data (Privacy) (Amendment) Bill 2021 (the Amendment Bill) on 29 September 2021, the amended provisions of the PDPO targeted on doxxing take effect on 8 October 2021.

    Please click here for the Personal Data (Privacy) (Amendment) Ordinance 2021.

    Please click here for the media statement issued by the Government on 8 October 2021.

    Please click here for the media statement issued by the PCPD on 8 October 2021.

    Major aspects of the amendments

    • Create offences to curb doxxing acts
      - To reflect the severity of doxxing cases, two new offences under a two-tier structure are introduced:
      • The first tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Any person who commits the first tier doxxing offence is liable on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years.
      • The second tier offence is an indictable offence for disclosing any personal data of a data subject without the relevant consent of the data subject; the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and the disclosure causes any specified harm to the data subject or any family member of the data subject. Any person who commits the second tier doxxing offence is liable on conviction on indictment to a fine of HK$1,000,000 and to imprisonment for 5 years.
      - The new offences offer protection not only to data subjects, but also to their family members.

    • Empower the Commissioner to carry out criminal investigation and institute prosecution
      - To step up enforcement against the doxxing offences, the Commissioner is empowered under the new provisions to carry out criminal investigation into offences under the section 64 of the PDPO as well as its related offences, and institute prosecution in the Commissioner’s own name for summary offences in the Magistrates’ Courts. Depending on the severity of the cases, the Commissioner will examine whether to institute prosecution in the Commissioner’s own name, or refer all the indictable offences, or cases involving commission of other offences to the Police for follow up and the Department of Justice for instituting prosecution.

      - The Commissioner is empowered with the following powers of investigation and arrest:

      • request the provisions of relevant documents, information or things (material) from any person, or require any person to provide the relevant materials and answer relevant questions to facilitate an investigation into doxxing and its related offences (including offences under the section 64 of the PDPO)
      • apply for a warrant to enter and search a premises, seize, remove and detain any material for the purpose of a specified investigation.
      • apply for a warrant to access, seize and detain an electronic device (such as a mobile phone) and decrypt material stored therein.
      • in urgent circumstance where it is not reasonably practicable to obtain warrant, the Commissioner may, without warrant, access an electronic device.
      • stop, search and arrest a person without warrant, if the person is reasonably suspected to have committed a doxxing or its related offences (including offences under section 64 of the PDPO )

    • Confer on the Commissioner statutory powers to demand the cessation of doxxing contents
      - With the advancement of technology, doxxing contents can be spread and reposted in a click. To remove doxxing contents in an expeditious manner, in relation to a message, whether in written or electronic form, including but not limited to those posted on online platforms, a cessation notice may be served if the Commissioner has reasonable grounds to believe that:
      • the personal data in question was disclosed without the relevant consent of the data subject;
      • the person disclosing the personal data had an intent to or was being reckless as to the whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject;
      • when the disclosure was made, the data subject was a Hong Kong resident; or was present in Hong Kong; and
      • a Hong Kong person is able to take a cessation action (whether in Hong Kong) in relation to the message.
      - An extra-territorial effect is introduced such that a cessation notice may be served by the Commissioner regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a Hong Kong person (e.g. an individual in Hong Kong and an internet service provider having a place of business in Hong Kong) or, in relation to an electronic message, a non-Hong Kong service provider (e.g operators of overseas social media platforms).

      - A cessation notice will specify the date on or before which the cessation action must be taken. If a person who receives the cessation notice contravenes the notice, that person commits an offence unless the person can raise a reasonable excuse with sufficient evidence to establish a defence.

      - An appeal may be made to the Administrative Appeals Board (“AAB”) against a cessation notice by any person who is affected by the notice within 14 days after the date on which a cessation notice is served. However, the appeal process does not affect the operation of the cessation notice and therefore any person who receives a cessation notice must still comply with its requirements within the timeframe specified therein pending the AAB’s decision. Depending on the circumstances, the Commissioner may, where appropriate, cancel a cessation notice by serving a written notice.

      - Besides, as there have been doxxing acts targeting specific persons or groups in the society, the Commissioner is empowered under the new provision to apply to the Court for an injunction to prevent the future recurrence of doxxing incidents targeted at specific persons or groups.


    Background of legislation

    • The Government submitted the Legislative Council (LegCo) Brief on the Amendment Bill to the LegCo on 14 July 2021, and gazetted the Amendment Bill on 16 July 2021.
    • The Amendment Bill aims to combat doxxing acts that are intrusive to personal data privacy, through the criminalisation of doxxing acts, and conferring on the Commissioner statutory powers to issue cessation notices demanding the cessation or restriction of disclosure of doxxing contents. The Amendment Bill also confers on the Commissioner power to conduct criminal investigation and institute prosecution for doxxing cases, so as to step up enforcement against doxxing cases.
      • Please click here for the Amendment Bill.
      • Please click here for the media statement issued by the Government.
      • Please click here for the paper submitted to the LegCo by the Government.
         
    • The Amendment Bill was introduced into the LegCo for first and second reading on 21 July 2021.
      • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
         
    • Secretary for Constitutional and Mainland Affairs and the Privacy Commissioner attended the first meeting of the Bills Committee on Personal Data (Privacy) (Amendment) Bill 2021 on 6 August 2021.
      • Please click here for the opening remarks by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
      • Please click here for the relevant papers of the meeting.
    • The resumption of the Second Reading debate and the Amendment Bill took place at the Legislative Council (LegCo) on 29 September 2021, and the Amendment Bill was passed by the LegCo.
      • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the resumption of the Second Reading debate on the Amendment Bill (in Chinese only).
      • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the Committee Stage Amendments of the legislative process (in Chinese only).
      • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs in adopting the report by the Legislative Council (in Chinese only).
      • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the setting down of the Third Reading of the Amendment Bill (in Chinese only).

  • - Doxxing may constitute contravention of the Personal Data (Privacy) Ordinance (PDPO).

    • New provisions are introduced to create doxxing and its related offences, criminalise doxxing acts and provide the Commissioner with statutory powers to conduct criminal investigations and enforce the law, including the powers to serve cessation notices to demand actions to cease or restrict disclosure of doxxing contents.
    • To reflect the severity of doxxing cases, two new offences under a two-tier structure are created:
      • The first tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Any person who commits the first tier doxxing offence is liable on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years.
      • The second tier offence is an indictable offence for disclosing any personal data of a data subject without the relevant consent of the data subject; the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of that the data subject; and the disclosure causes any specified harm* to the data subject or any family member of the data subject. Any person who commits the second tier doxxing offence is liable on conviction on indictment to a fine of HK$1,000,000 and to imprisonment for 5 years.
    • Below is a table summarising doxxing offences and their corresponding penalties.
    Section number Description of Offence Maximum Fine Maximum Imprisonment
    64(1) A person discloses personal data of a data subject obtained without consent from data user with intent to gain in money or property or to cause loss in money or property to the data subject. HK$1,000,000 5 years
    64(3A) A person discloses any personal data of a data subject without the relevant consent of the data subject; and has an intent to or is being reckless as to whether any specified harm* would be, or would likely be, caused to the data subject or any family member of the data subject. HK$100,000 2 years
    64(3C) A person discloses any personal data of a data subject without the relevant consent of the data subject; has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and the disclosure causes any specified harm* to the data subject or any family member of the data subject. HK$1,000,000 5 years
    66E(1) A person fails to comply with a requirement of a written notice issued pursuant to section 66D(2) of the Ordinance. On summary conviction: HK$50,000
    On conviction on indictment: HK$200,000    		 On summary conviction: 6 months
    On conviction on indictment: 1years
    66E(5) A person, with an intent to defraud, fails to comply with a written notice; or in purported compliance with a written notice, provide false and misleading material, answer, direction, explanations, particular or statement. On summary conviction: HK$100,000
    On conviction on indictment: HK$1,000,000    		 On summary conviction: 6 months
    On conviction on indictment: 2 years
    66I(1) A person, without lawful excuse, obstructs, hinders or resists any officers or a person assisting the officers in exercising the powers under the section 66G or 66H of the Ordinance. HK$10,000 6 months
    66O(1) Non-compliance of cessation notice. On a first conviction: HK$50,000
    In the case of a continuing offence, to a further fine of HK$1,000 for every day during which the offence continues.

    HK$100,000 on each subsequent conviction:HK$100,000
    In the case of a continuing offence, to a further fine of HK$2,000 for every day during which the offence continues.

    		 2 years

    2 years

    * Pursuant to section 64(6) of PDPO, “specified harm” consists of four limbs, including harassment, molestation, pestering, threat or intimidation to the data subject or any family member of the data subjects (known as “that person”); bodily harm or psychological harm to that person; harm causing that person reasonably to be concerned for that person’s safety or well-being; or damage to the property of that person.

  • - Doxxing may involve other offences.

    • Breaching an injunction order may be liable for contempt of court and subject to an immediate custodial sentence on conviction.
      • The High Court granted an interim injunction order (HCA 1957/2019) in October 2019 to restrain persons from disclosing personal data of police officers and their family members without their consent, with intention to intimidate or harass police officers and their family members. The order also restrains persons from intimidating or harassing police officers and their family members. It further restrains persons from assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
      • The High Court issued an interim injunction order (HCA 2007/2019) in October 2019 restraining persons from wilfully disseminating or publishing on internet-based platform or medium any material or information for the purpose of promoting, encouraging or inciting the use or threat of violence, with intention to cause bodily injury to any person or damage to any property within Hong Kong. The order also restrains persons from wilfully assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
      • The High Court issued an interim injunction order (HCA 1847/2020) in October 2020 restraining persons from disclosing personal data of judicial officers and their family members without their consent, with intention to intimate or harass judicial officers and their family members. The order also restrains persons from intimidating or harassing judicial officers and their family members. It further restrains persons from assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
    • In addition, depending on the circumstances, doxxing may also involve criminal intimidation, the offence of “access to a computer with criminal or dishonest intent”, etc.

  • - Doxxing may incur civil liabilities.

    • Doxxing causes anxiety and psychological distress to the victims, which include immense emotional and psychological pressure, burden and even harm. The reputation of the victims is also often damaged. They may file civil lawsuits to seek compensation from the doxxers.