The Hong Kong Government is proposing amendments to the Personal Data (Privacy) Ordinance (the “PDPO”) to combat doxxing acts. On 17 May 2021, the Constitutional and Mainland Affairs Bureau (the “CMAB”) published a discussion paper on the proposed amendments to the Personal Data (Privacy) Ordinance to combat doxxing acts (LC Paper No. CB(4)974/20-21(03)) (the “Paper”).
Doxxing is the act of publishing private or identifying information about an individual on the Internet, typically for malicious purposes, and has become more common in Hong Kong in recent years.
The Paper came more than a year after proposed amendment directions to the PDPO were put forward by the Privacy Commissioner for Personal Data, Hong Kong (the “Commissioner”) and the CMAB and discussed by the Legislative Council Panel on Constitutional Affairs (the “Panel”) (see our earlier posts here and here) back in January 2020.
The amendments
The Paper focuses on tackling the doxxing issue via three amendments to the PDPO.
(i) Introducing an offence to curb doxxing acts.
Currently, the PDPO does not specifically address doxxing acts. Section 64 of the PDPO provides that a person commits an offence if he discloses any personal data of a data subject obtained from a data user without the data user’s consent and the disclosure causes psychological harm to the data subject. Given the malicious disclosure involved in doxxing and the often repeated reposting it involves, it is difficult to ascertain the source of the data and whether it was obtained without the data user’s consent. Therefore an offence under section 64 is difficult to establish.
The proposed offence for doxxing (which will be added under section 64) requires a person to obtain the data subject’s consent, as opposed to the data user’s consent under the current section 64, before he/she discloses (e.g. public display) personal data of a data subject. Also, the new provisions not only protect the data subject, but also offer protection to his/her immediate family members. The proposed doxxing provision is set out below:
“A person commits an offence if the person discloses any personal data of a data subject without the data subject’s consent,
(a) with an intent to threaten, intimidate or harass the data subject or any immediate family member, or being reckless as to whether the data subject or any immediate family member would be threatened, intimidated or harassed; or
(b) with an intent to cause psychological harm to the data subject or any immediate family member, or being reckless as to whether psychological harm would be caused to the data subject or any immediate family member;
and the disclosure causes psychological harm to the data subject or any immediate family member.”
The proposed penalty on conviction for the doxxing offence is a fine of $1,000,000 and imprisonment for five years (for conviction on indictment), or a fine of $100,000 and imprisonment for two years (for summary conviction).
(ii) Empowering the Commissioner to carry out criminal investigation and prosecution.
Currently, the Commissioner is required to refer any criminal cases to the Police and the Department of Justice (the “DoJ”) for investigation and consideration for prosecution if there are reasonable grounds to believe that a criminal offence has been committed under the PDPO.
To improve enforcement of the doxxing offence, the Paper proposes to add new provisions to empower the Commissioner to carry out criminal investigation and initiate prosecution without the need to refer cases to the Police or the DoJ. This will be the first time the Commissioner has direct enforcement rights for criminal offences and will be limited to section 64 offences. The new powers could include:
- requesting relevant information, documents or things from any person, or requiring any person to answer questions to facilitate investigation when the Commissioner has reasonable grounds to believe there has been contravention of the new doxxing offence and other offences under section 64 of the PDPO;
- applying for the court’s permission to enter any premises when investigating the doxxing offence, which could cover seizure of documents or other property; and
- prosecuting in its own name cases of suspected contravention of the new doxxing offence and other offences under section 64 of the PDPO or failure to comply with the Commissioner’s requests related to criminal investigation.
This new powers will not extend to other offences under the PDPO, such as direct marketing offences under Part 6A of the PDPO.
(iii) Conferring on the Commissioner statutory powers to demand the rectification of doxxing content.
To handle doxxing cases most effectively, it is necessary to remove the doxxing content in an expeditious manner. The Paper therefore proposes that the Commissioner should be able to serve a “Rectification Notice” on online service providers in Hong Kong, directing the relevant online platform to rectify and/or remove any doxxing content. The Commissioner will specify in the Rectification Notice the concerned doxxing content, notify the person what rectification actions to take, and stipulate a deadline for compliance. An appeal mechanism against a Rectification Notice is also proposed to allow any person affected by the notice to make an appeal not later than 14 days after the notice is served.
The Paper also proposes a power for the Commissioner to apply for an injunction if he/she is satisfied that there is, or is very likely to be, a large-scale or repeated contravention of the new doxxing offence and other offences under section 64 of the PDPO.
Next steps
It is anticipated that a bill in relation to doxxing acts will be presented to the Legislative Council within this legislative year that is, by the end of October 2021.
With the introduction of the new doxxing offence and the grant of criminal investigation and prosecution powers to Commissioner, the Government seeks to regulate not only doxxers but also the online platforms concerned, giving the Commissioner more power to prevent malicious online activity against individuals.
