Skip to content

Doxxing

Doxxing Offences

  •  
    What is doxxing?
    Print
    • In general, doxxing refers to the gathering of the personal data of target person(s) or related person(s) (such as family members, relatives or friends) through online search engines, social platforms and discussion forums, public registers, anonymous reports, etc., and disclosure of the personal data on the Internet, social media or other open platforms (such as public places).
  •  
    The law
    Print
    Expand
    Collapse
    • - The Personal Data (Privacy) Amendment Ordinance 2021

      - Following the passing of the Personal Data (Privacy) (Amendment) Bill 2021 (the Amendment Bill) on 29 September 2021, the amended provisions of the PDPO targeted on doxxing take effect on 8 October 2021.

      Please click here for the Personal Data (Privacy) (Amendment) Ordinance 2021.

      Please click here for the media statement issued by the Government on 8 October 2021.

      Please click here for the media statement issued by the PCPD on 8 October 2021. 

      Major aspects of the amendments

      • Create offences to curb doxxing acts
        - To reflect the severity of doxxing cases, two new offences under a two-tier structure are introduced:
        • The first tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Any person who commits the first tier doxxing offence is liable on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years.
        • The second tier offence is an indictable offence for disclosing any personal data of a data subject without the relevant consent of the data subject; the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and the disclosure causes any specified harm to the data subject or any family member of the data subject. Any person who commits the second tier doxxing offence is liable on conviction on indictment to a fine of HK$1,000,000 and to imprisonment for 5 years.
        - The new offences offer protection not only to data subjects, but also to their family members.

      • Empower the Commissioner to carry out criminal investigation and institute prosecution
        - To step up enforcement against the doxxing offences, the Commissioner is empowered under the new provisions to carry out criminal investigation into offences under the section 64 of the PDPO as well as its related offences, and institute prosecution in the Commissioner’s own name for summary offences in the Magistrates’ Courts. Depending on the severity of the cases, the Commissioner will examine whether to institute prosecution in the Commissioner’s own name, or refer all the indictable offences, or cases involving commission of other offences to the Police for follow up and the Department of Justice for instituting prosecution.

        - The Commissioner is empowered with the following powers of investigation and arrest:
        • request the provisions of relevant documents, information or things (material) from any person, or require any person to provide the relevant materials and answer relevant questions to facilitate an investigation into doxxing and its related offences (including offences under the section 64 of the PDPO)
        • apply for a warrant to enter and search a premises, seize, remove and detain any material for the purpose of a specified investigation.
        • apply for a warrant to access, seize and detain an electronic device (such as a mobile phone) and decrypt material stored therein.
        • in urgent circumstance where it is not reasonably practicable to obtain warrant, the Commissioner may, without warrant, access an electronic device.
        • stop, search and arrest a person without warrant, if the person is reasonably suspected to have committed a doxxing or its related offences (including offences under section 64 of the PDPO )

      • Confer on the Commissioner statutory powers to demand the cessation of doxxing contents
        - With the advancement of technology, doxxing contents can be spread and reposted in a click. To remove doxxing contents in an expeditious manner, in relation to a message, whether in written or electronic form, including but not limited to those posted on online platforms, a cessation notice may be served if the Commissioner has reasonable grounds to believe that:
        • the personal data in question was disclosed without the relevant consent of the data subject;
        • the person disclosing the personal data had an intent to or was being reckless as to the whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject;
        • when the disclosure was made, the data subject was a Hong Kong resident; or was present in Hong Kong; and
        • a Hong Kong person is able to take a cessation action (whether in Hong Kong) in relation to the message.
        - An extra-territorial effect is introduced such that a cessation notice may be served by the Commissioner regardless of whether the disclosure is made in Hong Kong or not. A cessation notice may be served on a Hong Kong person (e.g. an individual in Hong Kong and an internet service provider having a place of business in Hong Kong) or, in relation to an electronic message, a non-Hong Kong service provider (e.g operators of overseas social media platforms).

        - A cessation notice will specify the date on or before which the cessation action must be taken. If a person who receives the cessation notice contravenes the notice, that person commits an offence unless the person can raise a reasonable excuse with sufficient evidence to establish a defence.

        - An appeal may be made to the Administrative Appeals Board (“AAB”) against a cessation notice by any person who is affected by the notice within 14 days after the date on which a cessation notice is served. However, the appeal process does not affect the operation of the cessation notice and therefore any person who receives a cessation notice must still comply with its requirements within the timeframe specified therein pending the AAB’s decision. Depending on the circumstances, the Commissioner may, where appropriate, cancel a cessation notice by serving a written notice.

        - Besides, as there have been doxxing acts targeting specific persons or groups in the society, the Commissioner is empowered under the new provision to apply to the Court for an injunction to prevent the future recurrence of doxxing incidents targeted at specific persons or groups.


      Background of legislation

      • The Government submitted the Legislative Council (LegCo) Brief on the Amendment Bill to the LegCo on 14 July 2021, and gazetted the Amendment Bill on 16 July 2021.
      • The Amendment Bill aims to combat doxxing acts that are intrusive to personal data privacy, through the criminalisation of doxxing acts, and conferring on the Commissioner statutory powers to issue cessation notices demanding the cessation or restriction of disclosure of doxxing contents. The Amendment Bill also confers on the Commissioner power to conduct criminal investigation and institute prosecution for doxxing cases, so as to step up enforcement against doxxing cases.
        • Please click here for the Amendment Bill.
        • Please click here for the media statement issued by the Government.
        • Please click here for the paper submitted to the LegCo by the Government.
           
      • The Amendment Bill was introduced into the LegCo for first and second reading on 21 July 2021.
        • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
           
      • Secretary for Constitutional and Mainland Affairs and the Privacy Commissioner attended the first meeting of the Bills Committee on Personal Data (Privacy) (Amendment) Bill 2021 on 6 August 2021.
        • Please click here for the opening remarks by the Secretary for Constitutional and Mainland Affairs. (Chinese version only)
        • Please click here for the relevant papers of the meeting.
      • The resumption of the Second Reading debate and the Amendment Bill took place at the Legislative Council (LegCo) on 29 September 2021, and the Amendment Bill was passed by the LegCo.
        • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the resumption of the Second Reading debate on the Amendment Bill (in Chinese only).
        • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the Committee Stage Amendments of the legislative process (in Chinese only).
        • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs in adopting the report by the Legislative Council (in Chinese only).
        • Please click here for the speech by the Secretary for Constitutional and Mainland Affairs at the setting down of the Third Reading of the Amendment Bill (in Chinese only).
    • - Doxxing may constitute contravention of the Personal Data (Privacy) Ordinance (PDPO).
      • New provisions are introduced to create doxxing and its related offences, criminalise doxxing acts and provide the Commissioner with statutory powers to conduct criminal investigations and enforce the law, including the powers to serve cessation notices to demand actions to cease or restrict disclosure of doxxing contents.
      • To reflect the severity of doxxing cases, two new offences under a two-tier structure are created:
        • The first tier offence is a summary offence for disclosing any personal data of a data subject without the relevant consent of the data subject, and the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. Any person who commits the first tier doxxing offence is liable on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years.
        • The second tier offence is an indictable offence for disclosing any personal data of a data subject without the relevant consent of the data subject; the discloser has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of that the data subject; and the disclosure causes any specified harm* to the data subject or any family member of the data subject. Any person who commits the second tier doxxing offence is liable on conviction on indictment to a fine of HK$1,000,000 and to imprisonment for 5 years.
      • Below is a table summarising doxxing offences and their corresponding penalties.
      Section number Description of Offence Maximum Fine Maximum Imprisonment
      64(1) A person discloses personal data of a data subject obtained without consent from data user with intent to gain in money or property or to cause loss in money or property to the data subject. HK$1,000,000 5 years
      64(3A) A person discloses any personal data of a data subject without the relevant consent of the data subject; and has an intent to or is being reckless as to whether any specified harm* would be, or would likely be, caused to the data subject or any family member of the data subject. HK$100,000 2 years
      64(3C) A person discloses any personal data of a data subject without the relevant consent of the data subject; has an intent to or is being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and the disclosure causes any specified harm* to the data subject or any family member of the data subject. HK$1,000,000 5 years
      66E(1) A person fails to comply with a requirement of a written notice issued pursuant to section 66D(2) of the Ordinance. On summary conviction: HK$50,000
      On conviction on indictment: HK$200,000      		 On summary conviction: 6 months
      On conviction on indictment: 1years
      66E(5) A person, with an intent to defraud, fails to comply with a written notice; or in purported compliance with a written notice, provide false and misleading material, answer, direction, explanations, particular or statement. On summary conviction: HK$100,000
      On conviction on indictment: HK$1,000,000      		 On summary conviction: 6 months
      On conviction on indictment: 2 years
      66I(1) A person, without lawful excuse, obstructs, hinders or resists any officers or a person assisting the officers in exercising the powers under the section 66G or 66H of the Ordinance. HK$10,000 6 months
      66O(1) Non-compliance of cessation notice. On a first conviction: HK$50,000
      In the case of a continuing offence, to a further fine of HK$1,000 for every day during which the offence continues.

      HK$100,000 on each subsequent conviction:HK$100,000
      In the case of a continuing offence, to a further fine of HK$2,000 for every day during which the offence continues.      		 2 years






      2 years



       

      * Pursuant to section 64(6) of PDPO, “specified harm” consists of four limbs, including harassment, molestation, pestering, threat or intimidation to the data subject or any family member of the data subjects (known as “that person”); bodily harm or psychological harm to that person; harm causing that person reasonably to be concerned for that person’s safety or well-being; or damage to the property of that person.

    • - Doxxing may involve other offences.
      • Breaching an injunction order may be liable for contempt of court and subject to an immediate custodial sentence on conviction.
        • The High Court granted an interim injunction order (HCA 1957/2019) in October 2019 to restrain persons from disclosing personal data of police officers and their family members without their consent, with intention to intimidate or harass police officers and their family members. The order also restrains persons from intimidating or harassing police officers and their family members. It further restrains persons from assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
        • The High Court issued an interim injunction order (HCA 2007/2019) in October 2019 restraining persons from wilfully disseminating or publishing on internet-based platform or medium any material or information for the purpose of promoting, encouraging or inciting the use or threat of violence, with intention to cause bodily injury to any person or damage to any property within Hong Kong. The order also restrains persons from wilfully assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
        • The High Court issued an interim injunction order (HCA 1847/2020) in October 2020 restraining persons from disclosing personal data of judicial officers and their family members without their consent, with intention to intimate or harass judicial officers and their family members. The order also restrains persons from intimidating or harassing judicial officers and their family members. It further restrains persons from assisting, inciting or abetting others to commit any of the aforesaid acts. This interim injunction order is still in force at present.
      • In addition, depending on the circumstances, doxxing may also involve criminal intimidation, the offence of “access to a computer with criminal or dishonest intent”, etc.
    • - Doxxing may incur civil liabilities.
      • Doxxing causes anxiety and psychological distress to the victims, which include immense emotional and psychological pressure, burden and even harm. The reputation of the victims is also often damaged. They may file civil lawsuits to seek compensation from the doxxers.
  •  
    Personal Data (Privacy) (Amendment) Ordinance 2021 Implementation Guideline
    Print
    • To assist all parties to understand the amended provisions and criminal liabilities about doxxing, the PCPD has published the “Personal Data (Privacy) (Amendment) Ordinance 2021 Implementation Guideline”. Click here to view. 
  •  
    Education Information video
    Print
  •  
    Examples of the victims’ difficult situations
    Print
    • - Case 1：In fear of family members being
      harassed and daily life severely affected.
      Case 1
        
      - Case 2： Nuisance phone calls received
      late at night, making it difficult to get asleep.
      Case 2
      - Case 3： Shop forced to cease operation,
      leading to loss of income.
      Case 3
  •  
    PCPD combats doxxing acts
    Print
    • - The PCPD received the first doxxing case on 14 June 2019. As of end of December 2022, the PCPD handled more than 8,200 doxxing cases. For the period from 8 October 2021 (when the Amendment Ordinance came into effect) to 31 December 2022, the PCPD received a total of 791 complaints relating to the offences under the Amendment Ordinance.

      - Follow-up actions taken by the PCPD in respect of the doxxing cases include:
      • A hotline (3423 6666) has been set up to answer enquiries or complaints about doxxing behaviour.
      • To more effectively combat doxxing offences, the Criminal Investigation Division was set up to investigate cases related to suspected doxxing offences.
      • As of the commencement of the Amendment Ordinance, the PCPD had written more than 400 times to request the operators of a total of 18 websites, online social media platforms or discussion forums concerned to remove more than 7,400 web links involving doxxing. From 8 October 2021 (when the Amendment Ordinance came into effect) to 31 December 2022, the PCPD exercised the new powers under the Amendment Ordinance and issued 1,500 cessation notices to 26 online platforms, requesting them to remove over 17,700 web links involving doxxing.
      • As of the commencement of the Amendment Ordinance, the PCPD had referred over 1,500 cases to the Police for follow-up actions. Furthermore, the PCPD had referred 65 cases of possible violation of the interim injunction orders relating to doxxing to the Department of Justice for follow-up actions. During the period from 8 October 2021 (when the Amendment Ordinance came into effect) to 31 December 2022, the PCPD commenced 114 criminal investigations and arrested 11 persons with respect to 11 cases on suspected contravention of the new section 64(3A) of the Ordinance relating to “disclosing personal data without consent”.
      • In May 2022, the PCPD conducted a joint operation with the Police in a doxxing-related case. During the operation, a person was arrested for, among others, suspected contravention of section 64(3C) of the Ordinance relating to the offence of “disclosing personal data without consent, causing specified harm to the data subject or his/her family member”.
      • In addition, during the period from 8 October 2021 to 31 December 2022, the PCPD referred 26 cases to the Police relating to the suspected contravention of section 64(3C) of the Ordinance concerning the disclosure of personal data without consent which caused specified harm to the data subject or any of his/her family members.
      • The PCPD has sought the cooperation of regulatory authorities locally and in different jurisdictions to combat doxxing on social media platforms.
      • To enhance the public awareness of and compliance with the Amendment Ordinance, the PCPD launched a series of publicity and educational campaigns, including broadcasting short videos, TV and radio announcements, distributing promotional leaflets and posters, organising seminars/webinars and promoting the new provisions on social media platforms. As of 31 December 2022, the Privacy Commissioner and colleagues of the PCPD have conducted 31 webinars/seminars on the Amendment Ordinance with a total of more than 4,200 participants.
      • In addition, the PCPD published the “Personal Data (Privacy) (Amendment) Ordinance 2021 Implementation Guideline” regarding the scope of new doxxing offences, the powers to conduct criminal investigation, institute prosecution and issue cessation notice under the Amendment Ordinance. This Guideline facilitates members of the public to comply with the requirements of the Amendment Ordinance.
  •  
    Court decisions
    Print
    • Section 64(2) of the PDPO (replaced by the newly added sections 64(3A) and 64(3C) )
      • November 2020: The defendant who obtained the personal data of a family member of a police officer for doxxing by using his office computer was charged with, among others, an offence under section 64(2) of the then PDPO. The defendant, who was convicted after trial in October 2020, was sentenced in November to imprisonment for 18 months. Together with other convictions, he was sentenced to imprisonment for 24 months.
      • February 2021: A nurse who worked in a clinic captured screenshots containing the personal data (including name, HKID card number, date of birth and phone number) of a police officer. She then uploaded the screenshots together with some derogatory comments to her social media account. She was charged with, among others, an offence under section 64(2) of the then PDPO. The defendant was convicted after trial and was sentenced to 240-hours’ community service order in February 2021.
      Section 64(3A) of the PDPO
      • December 2022: The defendant disclosed on four social media platforms the personal data of his ex-girlfriend without her consent. The defendant also impersonated the victim to open accounts on three of the said platforms. The defendant stated in the relevant messages that the victim welcomed others to visit her at her residential address. The court convicted the defendant of seven charges of the doxxing offence of section 64(3A) of the PDPO upon his guilty plea. After considering the relevant reports, the court sentenced the defendant to 8 months’ imprisonment.
      “Doxxing” related offences
      • In September 2021: A former clerical assistant of the Immigration Department obtained the personal data of 215 persons, including government officials, judges, police officers and their family members, from the Immigration Department’s computer system without authorisation and provided the data to the channel administrator of the social media platform Telegram for publication. The defendant had pleaded guilty earlier to one count of “misconduct in public office” and was sentenced to imprisonment for 45 months.
      Court’s Interim Injunction Orders
      • June 2020: The defendant was charged with contempt of court for sharing the personal data of a police officer and his family on her social media account, in violation of the interim injunction order (HCA 1957/2019) granted by the High Court in 2019 relating to doxxing. The defendant was found guilty in June 2020 and was sentenced to 28 days’ imprisonment, suspended for one year.
      • October 2020: The defendant was charged with contempt of court for posting the personal data of a police officer on her social media account, in violation of the interim injunction order (HCA 1957/2019) granted by the High Court in 2019 relating to doxxing. In October 2020, the defendant pleaded guilty to the charge and was sentenced to 28 days’ imprisonment, suspended for one year.
      • In this case, Mr Justice Russell Coleman stated in the judgment that the impact of doxxing on victims is “severe and long-lasting”. “Subject to mitigating factors, if any, the starting and primary penalty is imprisonment. The normal penalty for breaches of injunction orders is imprisonment measured in months.”
      • December 2020: The defendant was charged with contempt of court for posting the personal data of a police officer and his family members on a social media platform, in violation of the interim injunction order (HCA 1957/2019) granted by the High Court in 2019 relating to doxxing. In December 2020, the defendant was convicted of civil contempt of court and sentenced to 21 days’ immediate imprisonment.
      • In the judgment, Mr Justice Russell Coleman pointed out that “the impact of doxxing on victims is severe and long-lasting”. “Once personal data has been publicly revealed on the internet or social media, even if the original point of revelation is subsequently removed, that personal data will almost certainly forever remain publicly available”. The doxxing act is “wholly unforgivable” and “should not be tolerated”. As the Court considered that the contempt of this case would not properly be reflected in a suspended custodial sentence, the defendant was sentenced to immediate imprisonment
      • December 2020: The defendant was charged with contempt of court for posting the personal data of a police officer and his wife on a social media platform, in violation of the interim injunction order (HCA 1957/2019) granted by the High Court in 2019 relating to doxxing. In December 2020, the defendant was convicted of civil contempt of court and sentenced to 21 days’ imprisonment, suspended for one year. 
      • January 2022: The defendant was charged with contempt of court for posting a photo of a police officer and messages inciting violence, in violation of the interim injunction order (HCA 2007/2019) granted by the High Court in 2019. In January 2022, the defendant pleaded guilty to the charge and was sentenced to 21 days’ imprisonment, suspended for 12 months.
      • April 2022: The defendant was charged with contempt of court for publishing an article on social media platform inciting violence against the Police, in violation of the interim injunction order (HCA 2007/2019) granted by the High Court in 2019. In April 2022, the defendant pleaded guilty to the charge and was sentenced to six weeks’ imprisonment.
      • April 2022: The defendant was charged with contempt of court for publishing a post on social media platform inciting violence against the Police, in violation of the interim injunction order (HCA 2007/2019) granted by the High Court in 2019. In April 2022, the defendant pleaded guilty to the charge and was sentenced to one month’s imprisonment, suspended for 12 months.
      • October 2022: The defendant was charged with contempt of court for making 8 nuisance calls to a judicial officer and his wife, in violation of the interim injunction order (HCA 1847/2020) granted by the High Court in 2020 relating to doxxing. In October 2022, the defendant pleaded guilty to the charge and was sentenced to 14 days’ imprisonment, suspended for 12 months.
  •  
    Seek assistance
    Print