HK privacy watchdog seeks law amendments to investigate doxxing

Hong Kong's privacy watchdog is seeking law amendments that would give it powers to investigate and prosecute cases relating to cyberbullying and doxxing. The privacy commissioner's request came in response to a remarkable surge in such abuse since the prolonged anti-government protests started seven months ago.

At a news briefing on Tuesday, Privacy Commissioner for Personal Data Stephen Wong Kai-yi warned of widespread digital violence involving "weaponized" personal information used to attack people with opposing political views.

He proposed amending the Personal Data (Privacy) Ordinance, enacted about two decades ago, so it will allow the watchdog to prosecute offenders.

His recommendation included new legislation to make reporting of cases of data breaches mandatory, according to a document submitted to the Legislative Council on Monday.

Since June, 4,370 doxxing complaints have been reported to or discovered by the privacy commissioner – 75 times more than the total number in 2018.

Thirty-six percent of complaints were related to police officers and their families; their names, photos, addresses and phone numbers were posted online by radical protesters.

Doxxing cases targeting people who support the government and the police force accounted for another 30 percent.

The commissioner has referred 1,402 cases to the police for investigation as criminal doxxing. As of Dec 31, only eight people have been arrested, leading to one prosecution.

Stephen Wong attributed the low rate of prosecution to strained police resources and difficulties with collecting evidence. He added that his professional team was the best option to deal with doxxing and other privacy-related cases.

He said this legislation would make law enforcement more effective as the commissioner was often cited as "a toothless tiger" due to a lack of enforcement action and deterrents.

Before the "Extradition Bill Incident" started, doxxing was mostly among former friends and associates who vented their anger and frustration with one another. It was generally non-criminal and only contravened Data Protection Principles, the commissioner said.

However, the rising number of cases since June has been carried out with the intention of intimidating other people. This is a criminal behavior, he said, suggesting that an administrative fine would be more effective in such cases.

Legal expert Kennedy Wong Ying-ho said changes to the law, though helpful, would have only a limited impact on curbing the unlawful practice. The main problem lies in the difficulties with gathering evidence, he said, as many posts were published through overseas IP addresses.

Under the current ordinance, the disclosure of private data which incurs financial losses or psychological harm is an offense punishable by up to five years in prison and a maximum fine of HK$1 million ($128,600).

Any offender who does not comply with an enforcement order from the commissioner to rectify data abuses faces a maximum fine of HK$50,000 and two years' imprisonment.