Hong Kong employees of websites based overseas will be liable to arrest if their bosses fail to remove doxxing data from the platforms, under a new legal amendment to criminalise the malicious publishing of personal data, Secretary for Constitutional Affairs Erick Tsang has warned.
Anyone found to have committed doxxing may face a fine of up to HK$1 million and five years in prison, according to a government proposal to amend the Personal Data (Privacy) Ordinance, submitted to the legislature last week. Those who fail to comply with removal requests from the authorities may be fined up to HK$100,000 and sentenced to two years’ imprisonment.
The privacy watchdog is working with the Department of Justice on the amended bill to expand its powers, Privacy Commissioner Ada Chung said at the legislature on Monday.
Overseas websites and platforms must comply with local laws, so the companies concerned will likely comply with government requests rather than commit a criminal offence, Chung said.
“A lot of these overseas platforms will have operational or management staff in Hong Kong. We can catch these people,” Tsang said. “I believe they will be relatively cooperative with the notices.”
Government requests to remove online doxxing information are currently often ineffective since websites or service providers respond too slowly or cannot be identified since they are located overseas, Hong Kong Federation of Trade Unions lawmaker Alice Mak said during a Legislative Council session on Monday.
“Would the ultimate solution be to ban these websites or platforms?” Mak said. “Shouldn’t the commissioner be given the power, or specify in the ordinance the procedures the commissioner could take to have these websites banned?”
Any changes to privacy laws to target doxxing should also be made in tandem with amendments that will require users of pre-paid SIM cards to register, so perpetrators can be more easily identified, she said.
Legislator Ma Fung-kwok questioned whether the government had the capability to bar websites containing doxxing information from being accessible in Hong Kong.
“Our current conception is that when we see such content believed to have violated the law, I can issue such a ‘correction notice’ without going through a court,” Chung said. Such notices may grant “wider” powers to the privacy commissioner than removal requests.
“We will not rule out that [the amendments] may have the power” to ban websites on a case-by-base basis, for example if an entire website is dedicated to hosting personal data for doxxing, Chung said in response to Alice Mak’s comments.
In January, the privacy watchdog revealed that among the 5,400 reports of doxxing cases it had received since June 2019, 38 per cent were linked to police officers and their family members, while 30 per cent involved people who supported the force or the government. Journalists also became the targets of doxxing during the 2019 unrest, including employees of the pro-democracy newspaper Apple Daily and of public broadcaster RTHK.