In the second half of 2019, there were reportedly an astonishing 4,370 doxxing cases, invariably associated with the protest movement. As it was intended, the malicious posting of personal details took a toll on many fine people, and it was obvious that the criminal law was inadequate to protect them. Doxxing is always a heinous crime, and, however it was dressed up by protest sympathizers, right-thinking people were left in no doubt that those responsible were no better than common criminals, and deserving of no sympathy.
When people talk about doxxing, they have in mind the unauthorized disclosure of personal data, invariably online, with a view to causing the victim harm, or at least attempting to do so. Its consequences may be grave, and it can cause both physical and psychological hurt. Although the protest movement primarily targeted police officers and their families, other public officials, including judicial officers and legislators, were also victimized, along with their relatives, and something had to be done.
On Oct 8, 2021, therefore, the Personal Data (Privacy) (Amendment) Ordinance was enacted, and it contains a raft of measures to counter malicious privacy violations. Doxxing can now be prosecuted either as a summary offense, for which the maximum penalty is a fine of HK$100,000 ($12,740) and two years’ imprisonment, or else as an indictable offense, which carries a fine of up to $1 million and five years’ imprisonment. Such penalties should certainly have given potential offenders pause for thought, although they may need to be reviewed if they prove not to be sufficient of a deterrent.
Apart from criminalizing doxxing activity, the amendments empower the Privacy Commissioner for Personal Data to conduct criminal investigations, to prosecute doxxing-related offenses, to serve cessation notices on, for example, internet service providers, to seek injunctions, to search premises and electronic devices, and to make arrests. These new powers were long overdue, and those whose jobs place them at risk of doxxing will hopefully now breathe somewhat easier.
After the chief executive, Carrie Lam Cheng Yuet-ngor, on Feb 4, 2021, pledged to bring in new laws to combat doxxing, along with hate speech and fake news, the privacy commissioner, Ada Chung Lai-ling, who took office in 2020, took up the cudgels. Apart from helping to formulate the legislative proposals, she was also a vocal advocate for change, and her earlier experience came in handy. In her previous incarnation as registrar for companies, she was heavily involved in the rewrite of the Companies Ordinance, a massive undertaking designed to modernize the city’s company law, and that experience undoubtedly stood her in good stead.
Once the new provisions were in place, it then fell to Chung to ensure they were effectively deployed, just as she had done previously once the amended Companies Ordinance came into effect in 2014. Indeed, the privacy office has been hyperactive since last October, and the statistics speak for themselves. The first arrest was made in December, and members of the public, spurred by a high-profile publicity-cum-education campaign, have not been slow in coming forward with their complaints. A more moralistic climate, and one that values decency, has now been ushered in, and the rights of people to data privacy are being increasingly appreciated.
Through legal recruitment, Chung has beefed up her office’s in-house prosecutorial capability, and, when she appeared before the Legislative Council on May 17, she disclosed that six criminal suspects had been arrested since October, with 66 criminal investigations having been launched. She was also able to reveal, presumably to the delight of her audience, that, in the previous week, her office had cooperated with the Police Force to arrest a suspect who allegedly leaked the personal information of not only police officers but also of 70 legislators and their family members.
On May 20, moreover, the privacy office announced that it had, in the first case of its type, charged a suspect with four offenses of “disclosing personal data without consent”, after an investigation arising out of the disclosure of the personal data of two people on a social media platform amid a money dispute. A charge of this sort can only be brought under the Personal Data (Privacy) Ordinance in two situations, involving unauthorized disclosure of personal data with intent either to cause any specified harm to the data subject or a family member, or else being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or a family member. The suspect appeared in court on May 25, and prosecutions like this will hopefully put people on notice that doxxing will not be tolerated.
Apart from criminal cases, Chung also told the legislators that her office had requested the removal of over 3,500 messages on 13 online platforms, including the protest-friendly and London-based Telegram, and that 80 percent of them were deleted, with officers following up on the remainder. The public impact of the new law was, she said, illustrated by the 368 doxxing complaints received by the end of April. This was a sure sign of public confidence, given that it was six times higher than the figure for the seven months immediately prior to the enactment of the new law.
Chung also disclosed that her office handled 3,151 complaints in total in 2021, involving both doxxing and non-doxxing complaints. Out of this total, 842 complaints involved doxxing alone, and these included cases that were discovered through proactive investigations conducted by the privacy office’s cyber patrol, which undertakes online monitoring. Whereas 93 percent of the complaints were leveled against private institutions or individuals, the remaining 7 percent targeted government departments or public organizations.
While the amendments have given the privacy office far greater control of investigative and prosecutorial matters, it certainly does not mean it operates in a vacuum. Although, for example, it can now institute its own prosecutions, this is subject to the overall control of criminal prosecutions which the Basic Law vests in the Department of Justice (Art.63). The Police Force, moreover, is second to none when it comes to deploying investigative techniques in difficult situations. In practical terms, therefore, there needs to be constructive engagement between the various criminal justice partners, and this undoubtedly explains why Chung says she has “established a mechanism to strengthen cooperation with the police and the Department of Justice and will take joint action with police in appropriate cases”.
With the new anti-doxxing regime now up and running, it is apparent that the era of the doxxer is well and truly over. Of course, doxxing is unlikely ever to be wholly eradicated, but it will never again assume the proportions it did in its heyday, when it was repeatedly weaponized by the protest movement and its allies. Everybody can now see that the privacy office means business, and potential doxxers should realize they can no longer act with impunity.
The author is a senior counsel and law professor, and was previously the director of public prosecutions of the Hong Kong SAR.
The views do not necessarily reflect those of China Daily.
HONG KONG NEWS