Hong Kong’s proposed anti-doxxing law far too broad and vague, critics argue
- The bill opens the door to arbitrary accusations and has left internet service providers unsure of how to comply, legal and industry experts say
- But supporters of the legislation say it gives much-needed powers to the privacy chief and the burden of proof to convict is high
A day after details of the bill were made public, critics cautioned against forging ahead with what could be one of the toughest anti-doxxing laws in the world.
Critics on Thursday urged authorities to ensure the new law would not be used to protect the powerful and victimise specific groups such as journalists in an increasingly politicised and polarised environment.
The reach of the law remains long and wide, according to Paul Haswell, the head of the technology, media and telecoms practice at global law firm Pinsent Masons.
“Hong Kong has some of the harshest penalties for doxxing in the world, with custodial sentences for those who engage in doxxing even if no harm is actually caused,” Haswell said, assuming the bill would be passed.
“It is also extraterritorial, giving the privacy commissioner the power to issue a notice to remove content, or block access to that content, anywhere in the world.”
The law will empower the Office of the Privacy Commissioner for Personal Data to carry out criminal investigations and initiate prosecutions for doxxing, defined as the practice of maliciously leaking others’ personal information.
Under a two-tier structure of offences, anyone who discloses an individual’s personal data without consent “with an intent to cause specified harm or being reckless” about the harm caused faces a maximum penalty of two years in jail and a fine of HK$100,000 (US$12,875) for each summary conviction.
Facebook, Google ‘could stop offering services’ in Hong Kong over doxxing law
Under a second-tier indictable offence, the maximum penalty would rise to five years in jail and a fine of HK$1 million.
“Specified harm” includes harassment, molestation, threat, intimidation, bodily harm, psychological harm, harm causing a victim to be concerned about safety and damage to the person’s property.
The commissioner has the authority to apply for a warrant to enter and search premises and seize materials for investigation purposes and even access an electronic device without a warrant. Obstructing or resisting the search or arrest is an offence.
01:42
Hong Kong leader Carrie Lam says anti-doxxing law will only target illegal activities
“The penalties are very harsh even for a summary offence while the definitions are very vague. This is really draconian as it could give rise to arbitrary accusations about doxxing,” said Chung Kim-wah, deputy CEO of the Hong Kong Public Opinion Research Institute.
“Take the recent scandal of three top officials attending a dinner as an example. If somebody also revealed the identities of the other unknown guests, will this person be liable for doxxing?”
Chung was referring to customs chief Hermes Tang Yi-hoi, Immigration boss Au Ka-wang and deputy security minister Sonny Au Chi-kwong admitting they attended a hotpot dinner at a luxury clubhouse in March with other businessmen, and had been fined for violating social-distancing rules.
“I don’t think Hong Kong has a very serious issue of doxxing,” Chung said. “It seems the law aims to protect the authorities and officials from being scrutinised by the public, and to suppress freedom of expression.”
Hong Kong anti-doxxing law fears will be proven false, Lam assures tech giants
However a government spokesman noted on Wednesday that the privacy commissioner had handled more than 5,800 doxxing complaints between June 2019 and last month.
“The public has strongly asked the government to criminalise doxxing acts,” he said.
Data scientist Wong Ho-wa on Friday said the bill’s definition of doxxing was not clear enough in terms of defining what content qualified as personal information, something that could lead to self-censorship on platforms.
“The law will put pressure on Hong Kong’s technology companies, and could lead some to remove content they are afraid might breach the law. That will impact the free flow of information and free expression,” he said.
The government has said the law was not meant to target online platform service providers, noting the Asia Internet Coalition, which represents tech giants such as Google, Facebook, Twitter and LinkedIn, had said its members expressed willingness to keep operating in Hong Kong.
Ada Chung Lai-ling, the city’s privacy commissioner for personal data, on Friday said the regulator would demand that foreign companies operating online platforms take down doxxing content, but that local staff who lacked the authority to do so would not be held accountable.
“Once the law is passed, it is a criminal offence if overseas platforms fail to follow it,” she said.
The privacy commissioner will be empowered to order internet service providers (ISPs) to take down the offending content, regardless of whether the disclosure is made in Hong Kong or not.
Press group wants Beijing to rethink Hong Kong national security law
Anyone defying the request without a reasonable defence faces a maximum fine of HK$50,000 (US$6,435) and two years’ jail on the first conviction, and an additional fine of HK$1,000 per day until the material is removed.
“Even if the staff of these companies are found innocent, the accused will still face criminal proceedings. This may not be enough to dispel the fears of the technology providers in Hong Kong,” Haswell said on Thursday.
Lento Yip Yuk-fai, chairman of the Hong Kong Internet Service Providers Association, said the bill should clearly define “removal of the doxxing content”.
If it meant blocking access to the content, ISPs might need to remove the social media in question.
“For instance, ISPs can remove access to the whole Google search engine or the whole Facebook, but ISPs cannot prohibit access to partial content on Google or Facebook,” he noted.
07:30
Why China is tightening control over cybersecurity
Pro-establishment lawmaker and barrister Priscilla Leung Mei-fun insisted the penalties were not harsh, saying conviction required a high standard of proof and guilt beyond a reasonable doubt.
“The penalties should be sufficient to deter doxxing acts,” she said. “The privacy commissioner is very fair and they need to prove beyond reasonable doubt a person has committed this offence before he/she could be convicted,” she said.
Leung argued the commissioner needed sufficient powers to deal with doxxing offences or risked being a toothless tiger.
“There might be room for improvement and Legco could still propose amendments to the bill during our future discussions,” she said.
Lokman Tsui, assistant professor of Chinese University’s school of journalism and communication, called on the privacy commissioner to refrain from taking selective enforcement of the law.
“Many journalists have been the victims of doxxing and I hope that the commissioner would be fair in combating doxxing and not be in favour of particular groups of victims,” he said.
The bill, which will amend the Personal Data (Privacy) Ordinance, is expected to be passed before the current legislative session ends in October.
Additional reporting by Fiona Sun
