Anyone convicted in a district court of committing doxxing in Hong Kong may face a fine of up to HK$1 million and five years in prison, according to a government proposal to amend existing privacy laws tackling acts that “weaponise” personal data.
In a document submitted to the Legislative Council (LegCo) on Tuesday, the Constitutional and Mainland Affairs Bureau suggested making changes to the Personal Data (Privacy) Ordinance to tackle the malicious publishing of private or identifying data. It said that, while the authorities had made active efforts to enforce the privacy legislation, the legislation was “not intended to address doxxing acts committed in recent years.”
“Doxxing acts, which are intrusive to personal data privacy and in effect weaponise personal data, have caused great harm to the victims in the society in recent years,” the LegCo paper read.
The bureau said the Office of the Privacy Commissioner for Personal Data (PCPD) faced difficulties in tracing the sources of doxxing content, which was disseminated and repeatedly reposted on online platforms. The authorities hence could not verify whether the information shared was obtained from the data user “without consent” and could not take follow-up action, it said.
The privacy watchdog also lacked the legal power to make doxxing content removal requests mandatory, the government added.
In the proposal, the government suggested introducing an offence under section 64 of the privacy ordinance, to ban anyone from disclosing personal information without consent with an “intent to threaten, intimidate or harass” the data subject or their immediate family members.
HK$1 million fine, prison
The proposed legislation also outlaws the disclosure of personal data without the data subject’s consent with an “intent to cause psychological harm” to that person or any immediate family member.
“The relevant new doxxing provisions not only protect the data subject, but also offer protection to his/her immediate family members,” the bureau said.
Anyone who breaches the new doxxing offence is liable on conviction at district court level to a fine of HK$1 million and a five-year jail term. If found guilty by a magistrate, the offender can face a maximum penalty of a HK$100,000 fine and imprisonment for two years.
The government also proposed granting new powers to the Privacy Commissioner for Personal Data to conduct criminal investigation by requesting documents and other information from doxxing suspects. The commissioner may also apply for the court’s permission to enter premises and seize documents for investigation.
“Conferring the Commissioner with additional criminal investigation power can effectively expedite the processing of doxxing cases,” the government said.
Under the proposed changes, the privacy commissioner may initiate prosecution in doxxing cases and demand a “rectification” of doxxing content by serving a notice to online platform service providers. An appeal mechanism may be put in place, the bureau said, but people should first comply with the notice.
Chief Executive Carrie Lam vowed to take action against doxxing back in February, when she unveiled the government’s five major proposals for the current legislative year. She said at the time that the government wanted to tackle personal privacy infringements and the dissemination of “fake news” and hate speech.
According to the LegCo document, the PCPD received and uncovered more than 5,700 doxxing-related complaints between June 2019 – when the months-long anti-extradition bill protests erupted – and April 2021. During this period, police arrested 17 suspects for allegedly disclosing personal data obtained without consent from data users and two were convicted.
In January, the privacy watchdog revealed that among the over 5,400 doxxing cases they received since June 2019, 38 per cent were linked to police officers and their family members, while 30 per cent involved people who supported the force or the government.
Journalists also became targets of doxxing during the 2019 unrest. Many of the people who were doxxed were employees of the pro-democracy newspaper Apple Daily and public broadcaster RTHK.
The government’s proposal is set to be discussed in a meeting of the Panel on Constitutional Affairs in the legislature next Monday.