Staff members of a Hong Kong newspaper have claimed that their headshots posted on a “doxxing” website came from a Chinese travel agency that processes mainland visas.
Local online news outlet Stand News reported on Tuesday that photos and personal data of Apple Daily staffers had been published on a doxxing website recently. The tabloid is owned by pro-democracy media tycoon Jimmy Lai, who came under fire for supporting last year’s anti-extradition bill protests.
The website – which has since become inaccessible – contained the personal information of more than 100 Apple Daily employees. It published details including their full name, date of birth, contact number, job title and photo. The website offered HK$1,000 to 5,000 for tip-offs about “toxic journalists.”
Reporter Alvin Chan posted a Facebook status on Monday saying he believed his headshot on the doxxing website came from a photo he took in 2008. Chan said the photo was only used once when he applied for the mainland travel permit.
“In conclusion, there is only one photo source, that is the [mainland Chinese] agency,” he wrote.
Stand News cited information from the Office of the Privacy Commissioner for Personal Data as saying Apple Daily had reported at least 40 of more than 120 doxxed employees suspected their circulated photos came from their mainland travel permit applications. They said they had not published those photos publicly or used them to apply for other travel documents.
Responding to Stand News, the privacy watchdog said it had no legal power to monitor the collection and usage of personal data by the doxxing website since its domain was registered outside of Hong Kong. It also did not directly respond to whether it would investigate the Chinese travel agency, China Travel Service (Hong Kong) .
The office said it would contact the relevant jurisdiction and organisations to follow up on the matter, as well as urge the website to remove the suspected doxxing content.
HKFP has reached out to the China Travel Service (Hong Kong) for comment.
Hong Kong journalists have had their personal information exposed by anti-protest groups since large-scale demonstrations erupted in the city last June. A Russia-hosted website published information on 64 journalists which it called “black press that harm Hong Kong.” Most of them had ties with Apple Daily, while others were linked to public broadcaster RTHK and online publications like Stand News.
The website has also published personal data on high-profile pro-democracy figures including activist Joshua Wong, legal scholar Benny Tai and singer Denise Ho.
The Hong Kong Journalists Association condemned the website last September, saying it could have breached the Personal Data (Privacy) Ordinance: “Those acts have not only caused nuisance but also caused concern among the doxxed persons about their personal safety.”
The High Court granted an injunction on September 19 last year to ban the dissemination of personal information of Apple Daily‘s staff. The court also requested the website to take down the concerned content.
Days after the injunction was issued, a female Apple Daily reporter was tailed and attacked by four men after work. The newspaper reported that prior to the attack, the injured journalist’s personal data was put out online and she had received “suspicious calls.”
The interim injunction, which was meant to expire in October last year, was extended until further notice from the court. However, the doxxing website remained accessible; Joshua Wong’s profile was updated last week.
Update August 11: Responding to HKFP’s enquiries, China Travel Service said it strictly adhered to the law to protect information of travel permit applicants. The agency did not give answers to questions about how they stored applicants’ personal data, or how long the data was kept on their system.
“Regarding statements from individuals and media reporting that distort the facts, we reserve the right to take actions to hold them legally liable,” the agency said in an email reply last Friday night.
