Whether disclosing information that data subjects have themselves made publicly available on social media is allowed
The Enquiry
Why the Ordinance protects information that data subjects have themselves made publicly available on social media.
Our Response
Under section 2(1) of the Ordinance, “personal data” means data relating to a living individual from which it is practicable to identify the individual concerned and the data is in a form in which access to or processing of the data is practicable. Whether the information disclosed on social media is regulated under the Ordinance hinges on whether the information constitutes personal data under the Ordinance.
The personal data collected from the public domain (including social media) is still subject to the requirements under the Ordinance. Even if the data subject has disclosed his/her personal data online, it does not mean that the personal data is opened to unrestricted use where the use exceeds the data subject’s reasonable expectation of personal data privacy.
Anyone who collects and uses the personal data available in the public domain for “new purposes” without the consent of the relevant data subject may contravene the requirements of Data Protection Principle 3 of Schedule 1 to the Ordinance. Besides, anyone who discloses the personal data of another data subject without consent, whether recklessly or with intent to cause specified harm to the person or his/her family, such as harassment, molestation, pestering, threat, intimidation, bodily or psychological harm or damage to property, could commit the offence of doxxing. Please refer to The PCPD’s “Doxxing Offences” webpage for further information.
On the other hand, the PCPD urges members of the public not to disclose their personal data in public domain (including social media) arbitrarily, so as to avoid misuse by unscrupulous persons.
(Uploaded in February 2026)