Opinion | Doxxing clampdown: Privacy Commissioner implements public protections

By Grenville Cross

"Privacy is not something that I'm entitled to, it's an absolute prerequisite," said Marlon Brando.

When the Personal Data (Privacy) (Amendment) Ordinance became operational on Oct 8, 2021, many people had high hopes for it, although some doubted its efficacy. As it criminalized the unauthorized disclosure of personal data, its architects hoped it would herald a new era in the regulatory protection, and they were not mistaken. It may still be early days, but the Amendment Ordinance is already demonstrating its worth.

Throughout the insurrection of 2019-20, doxxing was a major problem, and it was widely used by hostile forces to wage war on society. Police officers, public servants and judicial personnel were targeted, together with their families, and the impact on the victims was often grave. Thus, in September 2021, when Judge Stanley Chan Kwong-chi sentenced an Immigration Department clerical assistant officer for misconduct in public office, for having unlawfully accessed the personal data of over 200 public officials and then posted it online, he described his behavior as "cyber-terrorism" and akin to "Internet Al-Qaeda", which was no exaggeration.

As the extremists sought to wreck Hong Kong, they weaponized the internet in a way the city had not previously experienced, and they used it to victimize people whose only "crime" was to try to defend the "one country, two systems" policy. At one time, it seemed they were largely above the law, given there was no dedicated anti-doxxing legislation, but no longer.

With the enactment of the Amendment Ordinance, the entire community, and not only law enforcement personnel, can breathe a sigh of relief. After all, cyberattacks endanger everyone, and also pose a major threat, for example, to commercial enterprises, including those providing online services and products, which are vulnerable to financial loss and reputational damage. Indeed, in 2019-20, cyberattacks accounted for about a quarter of all reported data breaches.

The Amendment Ordinance has provided the Privacy Commissioner for Personal Data, Ada Chung Lai-ling, who has overseen its formulation, passage and implementation, with wide powers. The Commission can now order the removal of doxxing messages, conduct criminal investigations, and prosecute doxxers. In embracing these challenges, Chung has revamped the Commission's operations, notably its enforcement arm.

This has involved beefing up both the Commission's investigatory and prosecutorial capabilities, and recruiting people with appropriate levels of expertise. They include private sector lawyers and former police officers, whose more advanced training is facilitated by the Department of Justice and the police force.

The Commission, however, does not operate in a vacuum, and the secretary for justice remains ultimately responsible for public prosecutions under the Basic Law (Article 63). What has changed, however, is the greater leeway the privacy commissioner now enjoys over cases arising within her purview, and she can now exercise increased prosecutorial discretion. That said, there is ongoing liaison with the Department of Justice over the more complicated cases, and it is also sometimes necessary for the Commission to seek police assistance when enforcement activity is problematic (or might be).

The legislative view of the seriousness of doxxing offenses is amply reflected in the penalties now available for offenders. Whereas the less serious crimes can be prosecuted in the Magistrates Court, where the maximum sentence is a fine of HK$100,000 ($12,800) and 2 years' imprisonment, those in the more serious category will be prosecuted in the District Court, where a judge can impose up to HK$1 million in fines and 5 years' imprisonment. Although the assembling of the evidence often requires painstaking investigation, given that any loopholes will be exploited by defense lawyers, the early signs are that Chung's investigative officers are more than equal to their task.

Indeed, between October 2021 and November 2022, the Commission received 740 doxxing-related complaints, a sure sign of public confidence in the new regime. In consequence, over 1,400 cessation notices have been issued to online platforms, requesting the removal of 16,500 doxxing messages, and over 90 percent have been deleted.

There have, moreover, been 109 criminal investigations since October 2021, with 10 resulting in arrests. Charges have been laid in three cases, and the first prosecution has yielded a positive outcome, which will serve as a fillip to the Commission in its burgeoning area of law enforcement.

On Dec 15, 2022, at Shatin Magistrates' Court, the defendant, Ho Muk-wah, pleaded guilty to seven doxxing offenses. The evidence showed that, after his personal relationship with the victim ended, he disclosed her personal data on four social media platforms, without her consent, and also impersonated her when opening accounts on three platforms. He then issued messages claiming she welcomed strangers to her home, as a result of which many people sought her acquaintance.

After Acting Principal Magistrate David Cheung Chi-wai said Ho's actions had a "very serious impact" on the victim and her family, he sentenced him to 8 months' imprisonment. This was clearly a landmark penalty, and it was welcomed by the Commission, which noted that "doxxing is not only illegal and immoral, it is also not a solution to problems."

Although one swallow does not make a summer, the outcome of this first prosecution is an early vindication of the Commission's techniques, and shows that doxxing will now be taken seriously. Everybody can now see that the Amendment Ordinance is capable of protecting people in different situations, and it will certainly give potential doxxers pause for thought. It may not be a magic wand, but it has great potential in terms of criminal justice, and other prosecutions are now in the pipeline.

On Dec 22, Chung, who described the sentence of 8 months' imprisonment as a "warning", also reminded the public to be wary of reposting or forwarding doxxing messages, given that this can also constitute an offense. She was, moreover, also at pains to emphasize that the Commission's strategy is multifaceted, ranging beyond prosecutorial action. A series of publicity and educational campaigns explaining the anti-doxxing law has been launched through various channels, including promotional leaflets, television and radio broadcasts, dedicated seminars and even a thematic website on "doxxing offences".

Notwithstanding its recent successes, the Commission has no intention of resting on its laurels. Chung says "we will scale new heights in the privacy protection landscape", and envisages a supporting role in regional initiatives. The Commission will be supporting "the development of Hong Kong into a technology and data hub in the Greater Bay Area, under the Outline Development Plan for the Guangdong-Hong Kong-Macao Greater Bay Area", and this is obviously visionary.

The author is a senior counsel and law professor, and was previously the director of public prosecutions of the Hong Kong SAR.

The article was first published in China Daily. The views do not necessarily reflect those of DotDotNews.