The Personal Data (Privacy) (Amendment) Bill 2021 (the Bill) aimed at combatting doxxing in Hong Kong was passed on 29 September 2021.
As discussed in our earlier post, the Bill amends the Personal Data (Privacy) Ordinance (PDPO) by:
- introducing offences to criminalize doxxing acts;
- empowering the Privacy Commissioner for Personal Data (the Commissioner) to conduct criminal investigations and institute prosecution for doxxing cases; and
- conferring on the Commissioner’s statutory powers to demand the cessation or restriction of doxxing content.
Among these changes to the PDPO, the Commissioner’s extra-territorial power to demand the cessation or restriction of doxxing content carries important implications to operators of online platforms and service providers in both Hong Kong and overseas.
Under the amended PDPO, if doxxing content is published on electronic platforms, the Commissioner has the power to issue cessation notices to Hong Kong persons or non-Hong Kong service providers to demand certain cessation actions to be taken, including:
- removal of doxxing messages from electronic platforms;
- cessation or restriction of access to the message or the relevant platform on which the message is published; and
- discontinuance of hosting services for part of or the entire platform on which the message is published.
Operators of online platforms and service providers should ensure that cessation notices are complied with, as non-compliance is a criminal offence. Offenders are liable to a fine of HK$50,000 and 2 years imprisonment for a first conviction, unless a defence can be established.
Online platforms operators and service providers should provide sufficient training to their staff to ensure that they have a proper understanding of the implications of the cessation notices and the amended PDPO. They should also establish internal procedures to ensure that they have the capabilities to comply with the notices, such as to remove the doxxing messages, in a timely manner.
The Bill will be gazetted as official law on 8 October 2021. We anticipate that the Commissioner will provide practical guidance to citizens and businesses to navigate the new changes to the PDPO. We will provide further updates when available.
