Hong Kong’s Legislative Bureau has proposed amendments to local laws that strengthen penalties for doxxing, and empower its Privacy Commissioner to request content removal from platforms and legally enforce compliance.
Doxxing became an issue in Hong Kong after the 2019 introduction of a law that would have made it easier for locals to be tried in Chinese courts. Protests against the law saw activists publish personal information about police and court staff.
From June 2019 until September 2020, the Office of the Privacy Commissioner for Personal Data handled over 4,700 doxxing cases. Of those doxxed, 35 percent where police officers or their family, four percent were public servants and government officials, 30 percent expressed support to the government or the police, and 32 percent voiced opposition to the government or police. Another 1,000 cases have popped up between September 2020 and April 2021.
Previously, an injunction made doxing potentially punishable by HK$1M (US$128K) and five years of imprisonment, but local prosecutors didn't have a precise section of local law they could point to as sanctioning the practice.
- Kids in Hong Kong and other highly surveilled states worry infosec careers are just asking for trouble
- Hong Kong teases tech to track residents as they move past QR codes
- Beijing pressures Alibaba to offload media assets, including Hong Kong's top newspaper
Proposed new amendments, detailed in a new paper [PDF], aim to make the practice explicitly illegal with changes to the Territory's Personal Data Privacy Ordinance (PDPO).
The amendments also seek to give Hong Kong's authorities the power to enforce content takedowns, which is needed because only two thirds of requests to platforms to remove doxxed content were successful.
Out of the total cases, 1460 were referred on to the police for violating section 64 of the PDPO, which the Privacy Commissioner for Personal Data Block detailed as:
Under section 64(2) of the PDPO, a person will commit an offence if he discloses, irrespective of his intent, any personal data of a data subject obtained from a data user without the data user’s consent and the disclosure causes psychological harm to the data subject.
So far, 17 people have been arrested and two convicted on doxxing charges. Both convictions resulted in 28 days imprisonment and suspension for one year.
The Constitutional and Mainland Affairs Bureau plans to submit a bill with the finished amendment within this legislative year.
Last November the bureau said:
Our aim is to endeavour to complete formulation of concrete legislative amendment proposals within next year and to consult the Legislative Council Panel on Constitutional Affairs followed by commencing legislative drafting work on the amendment proposal.