Skip to content

Response to Media Enquiry or Report

Response to Media Enquiry or Report

Date: 31 August 2020

Response to media enquiry on a website revealing personal data

Thank you very much for your enquiry of 27 August 2020. Our response is as follows:

“A doxxing website continues to operate freely.  Can I please ask the Privacy Commissioner's office:
  1. What steps did the Privacy Commissioner's office take between August 2019-August 2020 to get the profiles removed/site taken down?
  2. What strategy will the Privacy Commissioner's office take on this site going forward?
  3. Separately, there was a suggestion that Hong Kong's privacy laws would be strengthened this year -- can you please let me know what the latest is with these proposals? Has any legislation been drawn up/submitted in Legco for discussion?” 

Answer 1 :
  •  The office of Privacy Commissioner for Personal Data, Hong Kong (PCPD) has been invoking its powers conferred by the Personal Data (Privacy) Ordinance (PDPO) in a timely manner in following up on the websites under the name of “Hong Kong Leaks”.  After our follow-up actions, our online patrols reveal, as of now, 12 out of those 14 websites with the same modus operandi and design layout under different domain names are no longer in operation. Our follow-up actions have included the following :
    • The PCPD contacted those websites by email and urged them to remove and stop uploading all posts involving doxxing or illegal act.
    • Noting that the domain names of those websites were registered overseas, the PCPD liaised with the relevant domain registration or privacy authorities for their assistance and follow-up.
    • The PCPD contacted the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) to seek its assistance to liaise with its counterpart organisations in the relevant jurisdictions for follow-up. 
    • As the disclosure of personal data by those websites may involve contravention of section 64(2) of the PDPO (offence for disclosing personal data obtained without consent from data users and causing psychological harm to the data subjects), the PCPD referred the websites to the Hong Kong Police Force for criminal investigation and consideration for prosecution as the PCPD currently does not have criminal investigation or prosecution powers under the PDPO. 
    • The PCPD repeatedly reminded netizens publicly and through media statements of the possible contravention of section 64(2) of the PDPO, which is a criminal offence, and its maximum penalty.
  • To pursue investigations under the PDPO, it is necessary to identify the registrants of the domain names of the websites in question, the website operators and the data users who posted the personal data.  However, their identities are not disclosed to us despite our efforts.
  • With the absence of extra-territorial jurisdiction under the PDPO, the PCPD has no statutory power to order the overseas organisations (including the entities that assigned the domain names and the entities that hosted the servers) to disclose the website registrants’ or operators’ information. Up to the date hereof, the PCPD received no useful response despite previous attempts to contact the websites operators.

Answer 2 :
  • The PCPD has been enforcing the law in a fair and just manner in strict accordance with the powers and functions conferred by the PDPO, regardless of the background and occupation of the affected individuals or the doxxers. We would continue to endeavour to exhaust our powers and every possible avenue to get the doxxing posts taken down.

Answer 3 :
  • In January 2020, the Hong Kong SAR Government briefed the Legislative Council Panel on Constitutional Affairs (the Panel) on the preliminary directions to amend the PDPO. The amendment directions put forward by the Government are generally in line with those proposed by the PCPD to the Government earlier on.
  • While the Government has been working with the PCPD to conduct further in-depth study on concrete legislative amendment proposals, it is the prerogative of the Government in deciding the amendment legislation and its timetable of introduction into the Legislative Council.  The Government has also indicated that it would consult relevant stakeholders, including the Panel, in due course.