Hong Kong’s New Anti-Doxxing Regime.

 

In this note we consider the moves the Hong Kong Government is taking to outlaw and stop such behaviour
 

For the reasons explained below existing provisions 1 found in the Personal Data (Privacy) Ordinance ("Ordinance") to punish the non-consensual disclosure of personal data have largely failed to criminalise these types of acts.
 

At the moment, a criminal offence is committed on the disclosure of personal data of a data subject which was obtained from a data user2 , without the user’s consent, when this is done with an intention to:
 

(i) gain money or other property;
(ii) cause loss to the data subject; or
(iii) cause psychological harm to the data subject
 

 

An important element of the current offence is that the disclosure happened without the user's consent.
 

While scenarios such as the illicit disclosure of a patient's medical records from a hospital (as data user) would be within the scope of the current offence, when there are repeated disclosures of data the Hong Kong Police and Privacy Commissioner for Personal Data (the “Commissioner”) have struggled to trace the sources of the material, to ascertain who the data user was and/or to establish whether the data was obtained without the user's consent. So much so in fact between June 2019 and 2021 nearly 6,000 complaints of doxxing have been made but very few criminal convictions have followed.
 

 

Meanwhile, the Commissioner has made numerous requests to online platforms to remove links to offending material.

 

Because such removal was not mandatory, about 30% of the requests made have not been complied with.

 

 

For the above reasons, in mid-July the Bill was introduced to Hong Kong's Legislative Council to enact the laws for an all embracing anti-doxxing regime.

 

At the moment we do not know when the Bill will be approved however given the sensitive issues involved this is not expected to take long. The Bill's main objectives are to:
 

(i) further criminalize doxxing acts;
(ii) empower the Commissioner to investigate and prosecute offenders; and
(iii) confer the Commissioner with statutory powers to serve notices to cease or restrict disclosure of doxxing material (“Notices”).  

 

 

The Bill provides for a new summary offence criminalising disclosure of personal data without the data subject's (not the data user's) consent (an important change) with an intent to cause 'specified harm' to the data subject or their family or being reckless to such harm happening.
 

The new offence is much wider than the Ordinance's current provision. For example, it can be committed either intentionally or recklessly and it will be extended to cover both a data subject and their family members.

 

'Specified harm' is also very widely defined in the Bill as: (i) harassment, molestation, pestering, threat or intimidation; (ii) bodily harm or psychological harm; (iii) causing a person reasonably to be concerned for their safety or well-being; or (iv) damage to a person's property. 

 

It is not necessary that any specified harm happens for this new offence to be committed. It is enough that this was intended or you were reckless to that outcome. Even so and as a sign of the sensitivities of the matters, the offense is punishable with a fine of up to HK$100,000 and imprisonment for up to 2 years.
 

The Bill also provides for an indictable offence3 punishable with a fine of up to HK$1 million and imprisonment for up to 5 years when any specified harm actually occurs to the data subject or to their family. Again, this offence can be committed intentionally or recklessly.
 

 

The new offences can also be committed by companies4 .
 

According to general principles, criminal liability for a corporation depends on whether whoever performed the prohibited acts was part of its 'controlling mind'. So before a company can be found to have the necessary criminal intent or recklessness for a successful prosecution, a director or office holder of the company (i.e. the 'controlling mind') would need to have disclosed or been involved in the disclosure of the personal data with an:
 

(i) intention to cause the specified harm; or
(ii) awareness of the risks of specified harm happening, it being unreasonable to ignore the risks and nevertheless proceeding.
 

 

The Bill provides that the Commissioner will have new powers to: (i) arrest people without a warrant; (ii) obtain search warrants; and (iii) search and seize evidence.
 

In order to expedite the investigation of complaints, the new criminal investigatory powers to be given to the Commissioner will allow it to make requests for relevant documents and information and/or require that answers be given to their questions5 .
 

It will be a criminal offence without a reasonable excuse to: (i) fail to comply with the Commissioner’s requests for documents and information; (ii) fail to give an answer to a question; and/or (iii) give false or misleading statements in such answers.
 

It appears as a result there will be no right to silence at the investigatory stage.
 

The Bill also confers the Commissioner with the right to prosecute cases in its own name in the Magistrates' Courts. More serious matters are to be prosecuted by the Hong Kong Police and Department of Justice.
 

 

Given the internet's reach and to ensure the removal of offending material, the Bill proposes that the Commissioner may serve a Notice when there is an unlawful disclosure provided that: (i) the discloser has an intent or is being reckless about causing specified harm; and (ii) the data subject is a Hong Kong resident or is present in Hong Kong when the disclosure is made.
 

 

Unusually for Hong Kong criminal law and a sign of the seriousness of doxxing, a Notice can be served by the Commissioner regardless of whether the disclosure is made here or overseas.

 

However to ensure action is taken, a Notice may be served in Hong Kong (on an individual or an internet service provider having a place of business here) or, in relation to electronic messages, a service provider outside Hong Kong, such as an overseas social media platform. Whether such service on an overseas service provider is enough to ensure compliance with a Notice remains to be seen. 

 

Notices will require action to be taken within a designated timeframe. The Commissioner will identify in the Notice the content and specific action to be taken. If the Notice is not complied with a criminal offence can be committed unless the recipient can establish a defence of having a reasonable excuse for the failure to follow it.6 

 

 

Many companies and individuals have online platforms in this day and age.
 

Those with such a presence should now at the very minimum, so they cannot be recklessly liable for any wrongful disclosure of personal data on their platforms, consider:
 

– implementing or amending the terms and conditions of the platform prohibiting users from any doxxing activities whatsoever (e.g. users should be told not post any personal data belonging to other people on the platform);
 

– including warnings on the platform not to breach the Ordinance or Bill; and
 

– regularly checking the platform to ensure that activities undertaken on it are lawful, within the platform's rules and remove content that is believed to breach the Ordinance or Bill. Where there is an issue it would also make sense to quickly report it. Doing so is contrary to allegations of recklessness.
 

Conclusions 
 

The Bill provides for a new anti-doxxing regime which: (i) creates widely defined offences with heavy penalties; (ii) gives new strong investigatory powers to the Commissioner; and (iii) has extra-territorial effect in limited circumstances.

 

Individuals who post or release material allowing or hoping that doxxing happens are the main targets of the Bill.
 

However, hosts of online platforms, here or abroad, could easily become mixed up in such matters and should consider some or all of the above measures.
 

This Briefing Note was written by Ian Childs and Conrad Lam of Stephenson Harwood's Hong Kong office.