Doxxing is intolerable in any civilised society, and there’s no excuse for Hongkongers to flout the law

The wave of doxxing that has swelled in Hong Kong has tested the limits of morality and should be condemned. In a free society, while our own privacy is protected by the law, we should also respect the privacy of others

Ada Chung Lai-ling

Published: 6:45am, 8 Dec 2020

Why you can trust SCMP

Doxxing should not be tolerated in any civilised society, and I regret to note that personal data is being used nowadays in Hong Kong as a weapon to hurt, intimidate or silence others with different political views.

Doxxing involves gathering the personal data of a target or their family members and the subsequent disclosure of that data on the internet, social media or other open platforms without their consent. In a typical case, the most common personal data disclosed can include photos, Hong Kong identity card number, date of birth, occupation, phone numbers, address and names of family members.

From the particulars of the personal data disclosed, it is not surprising that some of the victims find themselves exposed to intimidation calls, cyberbullying or identity theft. In some cases, their names and other personal data were used to borrow money, order merchandise online or register for organ donation, causing distress to the victims or their family members.

The wave of doxxing that has swelled in Hong Kong since June last year has tested the limits of the law and morality, and should be condemned. In a free, open society, while our own privacy is protected by the law, we should also respect the privacy of others.

Freedom of speech and expression, while protected under the Basic Law and the Hong Kong Bill of Rights Ordinance, are not absolute rights. They do not encompass the freedom to carry out doxxing or cyberbullying.

02:31

What is the Basic Law of Hong Kong?

It is sad to see personal data being weaponised for personal attacks and retaliation against those who happen to hold different political views, not to mention those in authority or who are responsible for enforcing or administering the law. That the targets of doxxing can include the family members of victims is even more terrible and cries out for concerted efforts to address the problem.

In combating doxxing, since June 2019, my office has handled more than 4,900 related cases. To tackle this phenomenon, we have written more than 240 times to request that the operators of 18 websites, social media platforms or discussion forums remove more than 4,100 doxxing web links.

We have also urged the online platforms to post warnings that those who engage in doxxing could commit a crime under Section 64 of the Personal Data (Privacy) Ordinance.

As part of our enforcement efforts, we have referred more than 1,400 cases to the police for criminal investigation. We have also referred 48 cases that involved possible violation of the court’s interim injunction orders to the Department of Justice for them to follow up. Through our publicity efforts, we have appealed to the public to protect themselves from doxxing by avoiding casual or arbitrary disclosure of personal data.

Doxxing: the ‘weapon’ in Hong Kong’s protests had petty beginnings

In addition to being immoral, doxxing can also bring serious legal consequences. It could contravene Section 64(2) of the ordinance, which prohibits disclosing personal data obtained without consent and that the disclosure causes psychological harm to the subject. It is punishable by a fine of up to HK$1 million (US$129,000) and imprisonment for five years.

Doxxing could also be a crime under the Crimes Ordinance if there is evidence that the acts in question constitute criminal intimidation or access to a computer with criminal or dishonest intent. Doxxing victims can also begin civil litigation against the doxxer to claim compensation.

To combat doxxing, we have strengthened our collaboration with other law enforcement agencies and trade associations. As a result of our efforts, for example, the Hong Kong Licensed Money Lenders Association has asked its members to tighten their customer due diligence and verification procedures to prevent identity theft.

We also learned that the Department of Health has posted a warning notice on its website for registration for organ donation to deter people from using others’ personal data to make such donations.

03:41

A 'take two' at life : Organ-donation in Hong Kong

It is against this background that I welcome the court’s ruling in the first conviction of a case under Section 64(2) of the Personal Data (Privacy) Ordinance. In that case, the defendant used his position in a telecommunications company to obtain the personal data of a family member of a police officer and disclosed the data to a group on social media for doxxing. The defendant was convicted and sentenced to 18 months’ imprisonment.

Section 64(2) of the ordinance aside, the High Court has granted three doxxing-related interim injunction orders. They are meant to restrain people from disclosing the personal data of police and judicial officers and their family members, without their consent, to intimidate or harass them.

In June and October, the defendants in two cases were convicted of civil contempt of court for violating the court’s interim injunction orders. Both were sentenced to 28 days’ imprisonment, suspended for one year.

Although the sentence was suspended in both cases, Mr Justice Russell Coleman stated in the judgment of the latter case that the impact of doxxing on victims is “severe and long-lasting” and “the court should send a clear message to the public that such conduct is not tolerated in a civilised society”.

The judge also made it clear that, “subject to mitigating factors, if any, the starting and primary penalty for contempt of court in breaching an order in the nature of an injunction is imprisonment. The normal penalty for breaches of injunction orders is imprisonment measured in months.”

It is clear from this judgment that the violation of a court’s injunction is a serious matter. I urge everyone not to flout the law.

Ada Chung Lai-ling is Hong Kong’s Privacy Commissioner for Personal Data

Post