The Hong Kong government has decided to push forward with an amendment of the Personal Data (Privacy) Ordinance to criminalize doxxing acts on the internet with an extra-territorial effect after foreign IT firms raised their concerns.
Doxxing is the act of publicly revealing previously private personal information about an individual or organization. Facebook, Twitter and Google are among the major international tech companies that have collectively rung alarms about the ordnance and its potential impact on expression.
According to the draft of the Personal Data (Privacy) (Amendment) Bill 2021, the Privacy Commissioner for Personal Data (PCPD) will serve a cessation notice where there is a disclosure of personal data without the data subject’s consent.
It adds that if the discloser has intent or was seen as reckless about causing any specified harm to the subject or any family member by the disclosure, and the data subject is a Hong Kong resident or is present in Hong Kong when the disclosure is made, it can act.
When any doxxing content is disclosed on an overseas social media platform, both the platform’s operator and the internet service provider in Hong Kong will receive the notice and be required to take cessation action within a designated timeframe.
The notice will be served regardless of whether the disclosure of the doxxing content is made in Hong Kong or not.
Any person who receives a cessation notice but fails to comply will be subject to a fine of HK$50,000 (US$6,437) and two years imprisonment, plus a fine of HK$1,000 for every day during which the offense continues, on a first conviction.
The fine will be doubled on each subsequent conviction.
Anyone who fails to comply with a cessation notice can defend himself if “the technology necessary for complying with the cessation notice was not reasonably available” to him or her.
The bill will be gazetted on Friday while the Legislative Council will hold a first reading and commencement of the second reading debate on July 21. Media reports said the government planned to complete the legislation by October.
On June 26, the Asia Internet Coalition (AIC), a Singapore-based industry association with members including Facebook, Google and Twitter, submitted a letter to the Office of the PCPD asking for a meeting to talk about the proposed amendment.
The AIC said introducing severe sanctions and especially personal liability will have the consequence of encouraging online platforms to conduct little to no review of requests and over-block content. It said the proposed amendment will likely have a grave impact on due process and negatively impact freedom of expression and communication.
“The only way to avoid these sanctions for technology companies would be to refrain from investing and offering their services in Hong Kong, thereby depriving Hong Kong businesses and consumers, whilst also creating new barriers to trade,” said the AIC.
On July 5, the Wall Street Journal reported that Facebook, Twitter and Google had privately warned the Hong Kong government that they could stop offering their services in the city if authorities proceeded with the planned anti-doxxing changes.
However, the Hong Kong government said in a statement on July 6 that the letter sent by the AIC made no mention of the stance of individual company members nor were the coalition’s member companies planning to retreat from Hong Kong. It said it strongly opposed media reports that took matters out of context to mislead and confuse the public.
The government said Wednesday that the Privacy Commissioner had explained the purpose and scope of the bill to the AIC. It said both the AIC and PCPD had agreed to continue to strengthen communications in the future to enable the industry to better understand the purpose and content of the bill to allay any concerns.
On Friday, the AIC told Asia Times that it had no comments on the matter.
Wong Ho-wa, a member of the Information Technology Subsector of the Election Committee, said the content of the bill did not completely clear all the concerns as it did not offer a clear definition of doxxing acts.
Francis Fong Po-kiu, the honorary president of the Hong Kong Information Technology Federation, said most foreign IT firms including Facebook had their servers overseas and sales and marketing teams in Hong Kong.
Fong said it was unlikely that these sales and marketing staff would be prosecuted as they did not have the right to remove users’ content. Fong said most international social media platform operators had their legal teams overseas.
Edward Chin, a hedge fund manager and pro-democracy activist, said he thinks most international social media platforms will eventually be forced to leave Hong Kong due to the city’s tightening control on the internet. Chin said he would not be surprised if Hong Kong people would need virtual private networks (VPN) to go online one day, or if VPNs are eventually banned in the territory.
Since anti-extradition protests erupted in Hong Kong in June 2019, police and judges, among others, have become the target of privacy infringements.
In January, the police invoked the National Security Law to order local internet service providers (ISPs) to block access to HKChronicles, a website that shows the personal information of Hong Kong police officers and their family members.
Now, HKChronicles’ website can be viewed overseas but not in Hong Kong, while hkleaks.pk, which shows personal data of pro-democracy activists and politicians, is not blocked.
After the Privacy Ordinance is amended by the LegCo, the Privacy Commissioner will be empowered to order ISPs to block access to overseas websites with doxxing content if necessary.
The commissioner can also apply for a warrant to enter and search premises and seize materials for the purposes of a specified investigation in doxxing-related cases. In urgent circumstances where it is not reasonably practicable to obtain such warrant, the
commissioner may access an electronic device without a warrant.
Any person who commits a first-tier doxxing offense, which refers to the disclosure of personal data with an intent to cause specified harm to the data subject or his or her family member, is liable on conviction to a fine of HK$100,000 and two years in jail.
Any person who commits a second-tier doxxing offense, which refers to the disclosure of personal data that has caused specified harm to the data subject or his or her family member, is liable to a conviction on indictment to a fine of HK$1 million and to a five-year jail term.