The Office of the Privacy Commissioner for Personal Data (PCPD) is currently celebrating its 30th anniversary, and it has achieved much. It has, unsurprisingly, been in the spotlight, and it published its 2025 work report on Feb 3. It received 4,228 complaints last year, up 23 percent from 2024 (3,431). As might have been expected, the report had a heavy focus on the PCPD’s anti-doxing regime, which was in its fifth year.
During the insurrection of 2019-20, doxing was a major problem, and the authorities lacked effective means of combating it. It was maliciously deployed by hostile forces to undermine the morale of specific individuals and spread fear. Its victims included police officers, public servants, judicial officers, and pro-government elements, and the trauma suffered was sometimes severe. Whereas police officers and their families accounted for over 35 percent of the cases, the privacy commissioner of the day reported over 4,300 doxing-related cases in 2019, a seventy-fivefold increase on the previous year.
The personal information released included names, photographs, home addresses, telephone numbers, and even details of children’s schools. The data published led to individuals facing harassment via phone calls, fraudulent loan applications, physical intimidation, and even hostility toward children at school (because of their parents’ jobs). Various platforms were used to spread the doxing content, including Telegram, LIHKG, and Facebook. Although the PCPD urged the platforms to remove the content and referred over 1,400 cases to the police, there was, as the law then stood, only so much that could be done, and some improvisation was required.
For example, an immigration department official, Hung Wing-sum, who unlawfully accessed the personal data of more than 215 public officers from the department’s computer system and posted it online, causing distress, was charged in 2021 with the common law offense of misconduct in public office. The trial judge, Stanley Chan Kwong-chi, having described Hung as “Internet Al-Qaida” — and her actions as akin to “cyberterrorism” — sentenced her to 45 months’ imprisonment. In the absence of a dedicated doxing law, these alternatives, to a degree, helped fill the void, as did injunctions on online platforms to desist.
The privacy commissioner, Ada Chung Lai-ling, was appointed in 2020, at the tail end of the insurrection, and immediately prioritized the doxing threat. In July 2021, she spoke of her “grave concern that personal data has been weaponized by some in Hong Kong, and utilized in ways to intimidate, silence or harm others for whatever reasons”. She added, “The wave of doxing that has swelled in Hong Kong since mid-2019 has tested the limits of morality and the law, and should be stopped,” which then became a part of her mission.
The amendments empowered the privacy commissioner, for the first time, to oversee cases from start to finish, from investigation through to prosecution. The PCPD gained greater autonomy, and it was no longer necessary to involve the police or the justice department in every case
Once the immediate crisis involving the black-clad violence was contained, with the Hong Kong SAR National Security Law restoring normality in 2020, there was a welcome focus on criminalizing doxing. At that point, Chung stepped in and oversaw the preparation of the anti-doxing amendments and their passage through the Legislative Council. Once enacted, she was responsible for their effective implementation, and the latest statistics show just how successful the PCPD has been in protecting privacy rights.
After the Personal Data (Privacy) (Amendment) Ordinance became operational on Oct 8, 2021, there was a collective sigh of relief. Everybody who recognized that doxing was incompatible with a civilized society and endangered the rule of law hoped a page had been turned, and so it has proved.
The amendments empowered the privacy commissioner, for the first time, to oversee cases from start to finish, from investigation through to prosecution. The PCPD gained greater autonomy, and it was no longer necessary to involve the police or the justice department in every case. Cessation notices could also be issued, requiring offending platforms to stop disclosing doxing messages.
In 2025, the PCPD handled 308 doxing cases, including complaints and those uncovered through its “proactive online patrols”. This figure was 30 percent lower than in 2024 (442), indicating the growing effectiveness of the new legislation. In total, there were 299 doxing complaints, with 45.2 percent arising from monetary disputes and 24.4 percent involving family disputes.
Armed with its new prosecution powers, the PCPD initiated 147 criminal prosecutions in 2025 (arresting 18 suspects), and referred 47 cases to the police for further action. The suspects mainly doxed through social media platforms and instant messaging applications (67 percent), while the remaining 33 percent were concerned with doxing through the posting of leaflets and the displaying of banners. Moreover, cessation notices were issued to 13 online platforms, requesting the removal of 56 doxing messages, with an impressive compliance rate of over 98 percent.
Since 2021, the PCPD has undoubtedly had a significant impact in combating doxing-related problems. Between October, 2021 and December 2025, it handled 3,634 doxing cases and issued 2,104 cessation notices to 57 online platforms regarding 33,743 doxing messages. Moreover, it is noteworthy that although most of its cessation notices were issued to overseas online operators requesting the removal of doxing materials, the compliance rate exceeded 96 percent. This demonstrated the PCPD’s extraterritorial reach and must have greatly exceeded Chung’s expectations.
In 2025, moreover, only nine online doxing cases were uncovered by the PCPD’s “proactive online patrols”, a tiny fraction of the 1,134 cases in 2022 (the first full year after the enactment of the anti-doxing amendments). By any yardstick, this was huge progress. Although the PCPD received 299 doxing-related complaints last year, this represented a 53 percent decrease from the 2022 figure (630).
The picture that emerges, therefore, is of sustained progress through the determined application of anti-doxing measures. This has come about through what the PCPD calls “resolute enforcement, enhanced publicity and education efforts” over the past four years, coupled with “a more congenial atmosphere in the society” (a reference to the stability brought about by the national security legislation).
The PCPD’s report, therefore, reflects great credit on everybody involved in implementing the anti-doxing regime. It shows it has decisively turned the tables on the doxers and drawn a line under the problems of the recent past. In the process, Chung and her colleagues have done their bit to secure the future of the “one country, two systems” policy.
The author is a senior counsel and law professor, and was previously the director of public prosecutions of the Hong Kong Special Administrative Region.
The views do not necessarily reflect those of China Daily.
