HONG KONG: New anti-doxxing provisions now in force

With the coming into effect of the Personal Data (Privacy) (Amendment) Ordinance 2021 (“Amendment Ordinance”) on 8 October 2021, a new anti-doxxing law is now in force in Hong Kong.

The below sets out a summary of the key aspects of the anti-doxxing law:

  1. New offences of doxxing; new penalties

The Amendment Ordinance introduces two new offences of doxxing and corresponding penalties.

It is now an offence to disclose any personal data without the data subject’s consent with an intent to cause harm to the data subject or any family member of the data subject.

Depending on the severity of the offence, any person who commits the offence is punishable on conviction with:

      • a fine at level 6 (i.e. HK$ 100,000) and to imprisonment for 2 years; or
      • a fine of HK$ 1,000,000 and to imprisonment for 5 years if the disclosure causes harm to the data subject or any family member of the data subject.
  1. PCPD now has increased powers of investigation and prosecution

Significantly, the PCPD is now empowered to conduct criminal investigations and institute prosecution for doxxing offences.

Among other things, the PCPD will be granted wide powers to access documents and information from any person, or require any person to answer questions or provide relevant materials to facilitate an investigation in relation to doxxing offences.

The PCPD may also, with a warrant, enter premises and seize any materials or devices in the premises which may be relevant to the investigation as well as decrypt any material stored in these devices.

  1. Extra-territorial effect of the anti-doxxing law

The anti-doxxing provisions have extra-territorial effect.

The PCPD is now empowered to serve cessation notices to operators of electronic platforms including websites and online applications (regardless of whether these operators are based in Hong Kong or outside Hong Kong) where personal data has been disclosed without the individual’s consent.

The cessation notices will require the recipient of the notice to take steps to remove the doxxing content or restrict the disclosure of personal data which has been made.

Failure to comply with the cessation notice is an offence. Persons contravening the offence will be liable, on first conviction, to a fine at level 5 (i.e. at HK$50,000) and to imprisonment for 2 years.

Further guidance on the scope of the new doxxing offences and the powers of the PCPD to conduct investigations, institute prosecution and issue cessation notices is available at: Personal Data (Privacy) (Amendment) Ordinance 2021 Implementation Guideline

Companies which operate websites and other online platforms in Hong Kong should review their existing protocols and policies for dealing with posts that may constitute doxxing and therefore trigger the provisions under the Amended Ordinance.