An overview of the new Anti-Doxxing Regime

View PDF

Authored by: Michelle Wan

Anti-doxxing law was introduced in Hong Kong when the Personal Data (Privacy) (Amendment) Ordinance 2021 (PCPO) came into effect on 8 October 2021.  We discussed the new investigatory powers of the Privacy Commissioner for Personal Data (the PCPD) in our previous article.

The Office of the PCPD has recently reported on its work in 2022 (PCPD Report). On 8 March 2023, it was reported that an offender was convicted of 14 charges of the new doxxing offence upon her guilty plea and sentenced to two months imprisonment, suspended for two years.  This is the second case prosecuted by the PCPD since the new anti-doxxing regime took effect.

With the increasing reports of arrests and convictions under the anti-doxxing law, we take this opportunity to review how the law is enforced.

In the PCPD Report released on 9 February 2023, it was reported that until 31 December 2022, the PCPD had handled a total of 2,128 doxxing cases and initiated 114 criminal investigations.  32 cases were referred to the Police for further follow-up action.

As to arrest operations, the PCPD had by 31 December 2022, mounted a total of 12 arrest operations, including one in 2021 and 11 in 2022 (with one arrest made as a joint operation with the Police).  A total of 12 suspects were arrested.  The nature of disputes leading to the doxxing acts were monetary disputes (50%), work disputes (25%) and relationship disputes (17%).  The means used by the doxxers were social media platforms and instant messaging apps (92%), as well as posters (8%).

As at 31 December 2022, five of the arrested persons had been charged.  Two of them were convicted, with one sentenced.  That was the first conviction under the anti-doxxing law when the offender pleaded guilty to seven counts of disclosing personal data without consent and sentenced to 8 months’ imprisonment on 6 October 2022.  It is noteworthy that the offender was convicted less than four months after he was arrested in June 2022.

The public therefore should be reminded that doxxing is a serious offence and an offender can be liable on conviction to a fine of up to $1,000,000 and imprisonment for 5 years.  We recap on the important features of the law below.

Pursuant to section 64(3A) of the PCPO, a person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject:

According to section 64(6) of the PDPO, specified harm in relation to a person means:

The Privacy Commissioner is given broad investigation powers under the new regime.  It is empowered to conduct criminal investigations into doxxing-related offences and institute prosecutions, and has the authority to access electronic devices without a warrant under “urgent circumstances”, while a warrant is still required for entering and searching premises.

Apart from criminal investigations and prosecutions, the anti-doxxing law confers statutory powers on the Privacy Commissioner to serve cessation notices, to demand the removal of doxxing messages.  Between October 2021 and 31 December 2022, it is reported that the PCPD issued a total of 1,500 cessation notices to 26 online platforms, requesting removal of 17,703 doxxing messages, with a compliance rate of over 90%.

The multiple arrests have sent a clear message to the public that the anti-doxxing law is being robustly enforced in Hong Kong.  The new power given to the Privacy Commissioner and the streamlined process also effectively expedites enforcement actions against doxxing cases, resulting in speedy convictions.