My Take | Proposed doxxing law another case of legal overreach

The government’s bid to tackle perceived problems arising from the civil unrest in Hong Kong two years ago is changing the legal landscape and raising concerns about restrictions on free speech.

Few would question the need to combat doxxing, the malevolent posting of people’s personal details on digital platforms. But the proposed changes to data privacy laws intended to curb this menace are broad and come with heavy penalties. It is another case of legal overreach.

Cases of doxxing surged during the anti-government protests of 2019. Police officers and their families were the prime targets, but so were demonstrators, journalists, judges and others. There were culprits on both sides of the political divide. Victims were often harassed and threatened. This had a chilling effect on free speech as people refrained from expressing their opinions for fear of being doxxed.

It quickly became clear the city’s privacy laws were not well-equipped to tackle the problem. The courts granted injunctions in an attempt to fill the gap. The Department of Justice has shown, however, that existing laws can be stretched to cover doxxing, with more than 60 people arrested and some jailed.

The doxxing bill creates two new crimes. The less serious one, carrying up to two years jail, is that of disclosing personal data without the data subject’s consent. The offender must either intend to cause certain types of harm to the victim or their family or be reckless as to that happening.

The bill provides a comprehensive list of specified types of harm. The terms are broad and open to interpretation. They include harassment, molestation, pestering, threat, intimidation, bodily or psychological harm, damage to property or causing the victim to be concerned for their well-being.

A more serious crime, where the disclosure of details actually causes harm to the victim or a family member, can result in five years jail or a fine of HK$1 million (US$128,737).