Background

The LegCo announced, on 20 January 2020, its proposed amendments to the Personal Data (Privacy) Ordinance 1996 as amended in 2012 ('PDPO'). The proposed amendments aimed to introduce more severe fines in order to reflect the severity of the doxxing offence. In May 2021, the Constitutional and Mainland Affairs Bureau published a discussion paper on the proposed amendments, which confirmed that they included introducing an offence to curb doxxing acts, empowering the Commissioner to carry out criminal investigation and prosecution and conferring on the Commissioner statutory powers to demand the rectification of doxxing content.

Following this, on 16 July 2021, the PDPO Amendment Bill was introduced to the Gazette. At the time, the PCPD noted that the PDPO Amendment Bill focuses on combatting doxxing acts that are intrusive and violate privacy, by introducing the criminalisation of doxxing acts, and conferring on the PCPD statutory powers to issue cessation notices on such acts.

Key proposals

The PDPO Amendment Bill, as introduced, proposed to criminalise doxxing under a 'two-tier' structure, with penalties specified under the proposed amendments to the existing Section 64 of the PDPO. Tier one summary offences include the disclosure of personal data without the data subject’s consent, with an intent to cause any specified harm to the data subject or any of his/her family members or being reckless as to whether any specified harm would be, or would likely be, caused. The offender may face a maximum penalty of two years' imprisonment and a fine of HKD 100,000 (approx. €11,100). Tier two, however, is an offence where a first-tier summary offence is committed, but the offender may face indictment and a more severe penalty if the disclosure in fact causes the specified harm. For a second-tier indictable offence, the PDPO Amendment Bill proposed a maximum penalty is five years’ imprisonment and a fine of HKD 1,000,000 (approx. €110,900).

A key aspect of the proposed wording is the use of 'specified harm', as the proposed amendment to Section 64 gives a much wider meaning than 'psychological harm', which is specified under the PDPO. 'Specified harm' under Section 64(6) of the PDPO Amendment Bill proposed to refer to:

• harassment, molestation, pestering, threat or intimation;
• bodily harm or psychological harm;
• harm causing a person reasonably to be concerned for his safety or well-being; or
• damage to a person's property.

Furthermore, the offences extend to cover any specified harm intended to be inflicted on not only the data subject but also people who are related to the data subject by blood, marriage, adoption, or affinity.

A number of grounds of defence were proposed, including that an individual could be exonerated if they reasonably believed that the disclosure was necessary for preventing or detecting crime or that the data subject had agreed to the disclosure, or if the disclosure was required, authorised by law, or a court order, at the time of the disclosure. Furthermore, the PDPO had established a public interest defence under Section 64(4)(d), which the PDPO Amendment Bill proposed would only be available if the individual charged can prove the sole purpose of the disclosure was for a 'lawful' news activity.

Industry concerns

A number of technology companies voiced concerns that the PDPO Amendment Bill was too broad and could, as a result, hamper operations in Hong Kong. On 25 June 2021, the Asia Internet Coalition ('AIC') submitted a letter responding to the proposed amendments, in which the body warned that tech companies could stop offering their services in Hong Kong if the proposed changes came into force. The letter from the AIC further elaborated on concerns on the doxxing definition and addition to the PDPO as a new offence to combat such acts, commenting that doxxing under the legislation may be ambiguous in its scope as there is no universally accepted or acknowledged definition for doxxing, and may lead to a broad interpretation of doxxing and result to criminalising innocent acts of personal information disclosures online. The letter set out recommendations on doxxing as an offence, and proposed the establishment of legitimate situations where personal data may be disclosed without the data subject's consent, such as in the form of exemptions for legitimate purposes where personal information are disclosed. Moreover, among other things, the letter scrutinised that the PDPO and the PDPC may not be the appropriate statutory instrument for circumventing doxxing offences, and calls for a limitation on the scope of 'persons' and 'premises' where the PDPO would apply to.

The PCPD released a statement which confirmed that the PDPO Amendment Bill would have any bearing on free speech, which is enshrined under Article 27 of the Basic Law of the Hong Kong SAR and the Hong Kong Bill of Rights Ordinance. More specifically, the PCPD reiterated that the Bill concerns unlawful doxxing acts and the PCPD's related enforcement powers. Furthermore, the PCPD noted that the scope of the doxxing offence will be clearly set out, strongly rebutting any suggestions that the Bill will affect foreign investment in Hong Kong.

The AIC submitted further recommendations to the PCPD and LegCo, which included proposing the addition of adding an exemption for disclosure to obtain legal advice, if the relevant section of the PDPO Amendment Bill is intended to cover those arrested, being investigated, or required to provide assistance to the authorities, as the body noted this had not been built in.

Bills Committee deliberations

On 9 September 2021, the LegCo released a paper which reported on the deliberations of the Bills Committee on the proposed PDPO Amendment Bill. This paper highlighted that, while members are supportive of the PDPO Amendment Bill, concerns were raised over various issues with the proposed amendments. More specifically, these issues included the effectiveness of the suggested amendments in combatting doxxing activities, with the Committee suggesting the need to provide the PCPD with the statutory power to demand the cessation of disclosure of doxxing content. Furthermore, the Committee noted that the definition of 'family member' should be amended to include cohabiting partners, going as far as to suggest that the amendments should not only protect the data subjects and their family members, but also their working partners. In addition to these concerns, some committee members expressed the view that the prosecution of doxxing offences could be hindered as the prosecution has to prove the discloser's intent to cause specified harm, or recklessness as to whether any specified harm would be, or would likely be, caused to the data subject or his/her family members.

Final changes in the Amendment Ordinance

The PCPD announced, on 8 October 2021, that the PDPO Amendment Bill was gazetted and came into force on the same date. A Government spokesperson confirmed that the "[…] amendments focus on combating doxxing acts, and the scope of the offence is clear, focused and target-specific. The amendments also strike a reasonable balance between protection of privacy and freedom of speech."

In regard to the final contents of the Amendment Ordinance, the only change that was proposed and implemented was in relation to the defence provisions in connection with a cessation notice. The proposed Section 66O(2)(b)(iv) in the original PDPO Amendment Bill provided that it is a defence for a person charged with an offence under the proposed Section 66O(1) to establish that it was not reasonable to expect the person to comply with the cessation notice because there was a risk of incurring a civil liability arising in contract, tort, equity or otherwise. Aside from this change, the other proposals, such as the criminalisation of doxxing under a 'two-tier' structure and corresponding penalties, were kept in the final version of the Amendment Ordinance.

Furthermore, it was subsequently reported by the Bills Committee that such a defence had not been adopted in other Hong Kong legislation. Thus, an amendment was proposed to remove the aforementioned defence and replace it with an immunity provision, similar to those found under the Securities and Futures Ordinance or the Financial Reporting Council Ordinance. In those Ordinances, a person who complies with a cessation notice served on the person would not incur any civil liability, whether arising in contract, tort, equity or otherwise, to another person only because of that compliance. Therefore, it ensures that cessation actions are made quickly, while allowing recipients of cessation notices to be protected from potential civil liability arising from compliance with the cessation notice.

Conclusion

The PCPD has published an Implementation Guideline for the Personal Data (Privacy) (Amendment) Ordinance 2021 in the Hong Kong Gazette to accompany the Amendment Ordinance, which sets out the amendments and changes to the offences and sanctions. Moreover, the PCPD has set up a telephone hotline for handling enquiries or complaints relating to doxxing activities, and a portal with information on doxxing on the PCPD's website. The amendments imply that the PDPO Amendment Ordinance focuses on curbing doxxing offences, with an emphasis on the investigatory and prosecution powers of the PCPD and penalties for those who are convicted of the offence, as confirmed by the Government and the PCPD. Finally, as the Amendment Ordinance took effect on 8 October 2021, it remains to be seen what its impact will be and how it will be enforced.

Chanelle Nazareth Privacy Analyst
[email protected]