Following is a question by the Hon Alice Mak and a reply by the Secretary for Constitutional and Mainland Affairs, Mr Patrick Nip, in the Legislative Council today (January 8):
 
Question:
 
     Since the occurrence of the disturbances arising from the proposed legislative amendments, quite a number of persons have engaged in doxxing police officers and persons holding different views (i.e. searching for and disclosing their personal information and that of their family members on the Internet), and the doxxed information has subsequently been used by others for harassing and threatening the victims and their family members. Some persons holding different views have silenced themselves to avoid being doxxed. Moreover, the Office of the Privacy Commissioner for Personal Data (PCPD) has indicated that in view of the multiple difficulties encountered in investigating and following up doxxing acts, it is actively studying the introduction of amendments to the Personal Data (Privacy) Ordinance. In this connection, will the Government inform this Council:
 
(1) whether it knows the number of complaints, received by PCPD since the occurrence of the disturbances arising from the proposed legislative amendments, about personal data being disclosed on the Internet without the consent of the data subjects, and how many persons' personal data were involved in the complaints; among such complaints, the number of those involving doxxing acts; the details of the follow-up actions taken by PCPD;
 
(2) as some social platforms have repeatedly refused to provide to PCPD the registration information or Internet protocol addresses of persons who uploaded the doxxing postings, whether the existing legislation has empowered PCPD to prosecute those social platforms; if so, of the number of prosecutions instituted by PCPD since the occurrence of the disturbances arising from the proposed legislative amendments; if not, the measures PCPD has in place to deal with this situation before the relevant legislation is amended; and
 
(3) whether it knows the latest progress of PCPD's study on the introduction of amendments to the aforesaid Ordinance; whether the Government will accept the proposed legislative amendments of empowering PCPD to search for and seize evidence, and to conduct prosecution, etc., and whether it has drawn up a timetable for introducing such legislative amendments; if so, of the details; if not, whether it will draw up such a timetable; of the measures the authorities will take before the completion of the legislative amendment process, in order to protect the privacy of persons who have been doxxed during the disturbances arising from the proposed legislative amendments?
 
Reply:
 
President,
 
     After consulting the Security Bureau and the Office of the Privacy Commissioner for Personal Data (PCPD), my consolidated reply to the question raised by Hon Alice Mak is as follows:
 
(1) and (2) The Government is deeply concerned about the incidents of doxxing that took place over a recent period of time in the society. The PCPD received the first doxxing case related to the amendment of the Fugitive Offenders Ordinance on June 14, 2019. As at December 31, 2019, the PCPD has received and proactively uncovered over 4 300 doxxing-related cases, the latest number of cases is 4 700. The victims of doxxing are from all sorts of backgrounds and all walks of life with various views, among which police officers and their family members are the single largest sector of people falling victim to doxxing. Among these cases, over 1 500 cases (representing around 36 per cent of total cases) involved police officers and their family members. One hundred and eighty cases were related to doxxing on government officials and public servants (representing around 4 per cent of total cases). In addition to public servants, there are also members of the public (representing around 30 per cent of total cases) who were doxxed for stating their support for the government or the Police. On the other hand, some members of the public were doxxed after making online comments against the government or the Police (accounting for about 10 per cent of total cases). Some others were dissatisfied with the behaviour of protestors and disclosed their personal data online (accounting for about 20 per cent of total cases).
 
     Under the Personal Data (Privacy) Ordinance (PDPO), the Privacy Commissioner for Personal Data (the Commissioner) is empowered to conduct investigations and inspections, and is vested with the authority to discharge investigative functions, including entering into premises, summoning witnesses and requiring the persons concerned to furnish information to the Commissioner. However, the Commissioner has no authority to carry out criminal investigation or initiate prosecution on his own. At present, criminal investigations are conducted by the Police, and prosecutions, if so required, are initiated by the Department of Justice. As at December 31, 2019, the PCPD has referred more than 1 400 doxxing cases to the Police in accordance with the law for further criminal investigation.  It is currently stipulated under section 64(2) of the PDPO that any person who discloses any personal data of a data subject which was obtained from a data user without the data user's consent, and such disclosure causes psychological harm to the data subject, that person has committed an offence and is liable on conviction to a maximum penalty of a fine of HK$1,000,000 and to imprisonment for up to five years. As at December 31, 2019, a total of eight persons were arrested by the Police for alleged violation of such provision. On September 25, 2019, a man was charged with an offence relating to "conspiracy to disclosing personal data obtained without data users' consent" under section 64 of the PDPO for alleged improper disclosure of the personal data of other individuals on the Internet.  The case will be heard again by the court on January 15, 2020.
 
     Apart from referring the cases to the Police for follow-up, the PCPD has also reminded operators of relevant websites, online social media platforms or discussion forums that they should prevent their platforms from being abused as a tool for infringing personal data privacy. It has also requested the operators concerned to issue on their platforms warnings to netizens that doxxing behaviour may violate the PDPO. With regard to the doxxing cases, the PCPD has actively approached and written for over 140 times to operators of websites, online social media platforms and discussion forums involving doxxing postings, urging them to remove over 2 500 relevant web links, of which close to 70 per cent has been removed. The PCPD will continue to review relevant platforms and pursue follow-up and will spare no efforts in keeping doxxing in check.
 
     Furthermore, on October 25, 2019, the court granted an injunction order restraining any person from using, publishing, communicating or disclosing personal data of any police officer(s) or their family members intended or likely to intimidate, molest, harass, threaten or pester any police officer(s) or their family members without consent of the persons concerned; from intimidating, molesting, harassing, threatening or pestering any police officer(s) or their family members; or from assisting, inciting, abetting or authorising others to commit any of these acts. As at December 31, 2019, the PCPD has referred 40 cases it had received and found to have allegedly violated the injunction order of the court to the Department of Justice for follow-up.
 
(3) In response to the spate of major data breach incidents last year, we are now working with the PCPD to review and consider the amendments to the PDPO, with a view to better safeguarding personal data privacy. Drawing on the experience in handling the doxxing cases concerned over the past months, the PCPD reflected to us that there is room to enhance the PDPO for tackling the problem of doxxing, including to consider introducing legislative amendments to more specifically address doxxing, conferring on the Commissioner statutory powers to request the removal of doxxing contents from social media platforms and websites, as well as the powers to carry out criminal investigation and prosecution, etc. We are seriously examining how the PDPO should be amended with the PCPD. Relevant considerations include a number of legal issues related to the regulation of doxxing-related behaviour, such as how the offence should be defined and the need to strike a balance among the protection of personal data privacy, freedom of expression and free flow of information. We note that some other jurisdictions have started to take actions to regulate doxxing recently. For example, Singapore passed the Protection from Harassment (Amendment) Act 2019 last year. We will consider the actual circumstances of Hong Kong in the light of the relevant legislation of other jurisdictions on the regulation of doxxing, and consult relevant stakeholders in examining the direction and details of introducing legislative amendments.
 
     Prior to the completion of legislative amendments, the Police will continue to tackle doxxing in accordance with section 64 of the PDPO. The PCPD will actively pursue relevant work on safeguarding personal data privacy, including the referral of relevant cases to the Police for follow-up, proactive liaising and writing to operators of doxxing-related platforms to request the removal of relevant web links and issuance of warnings on the platforms to netizens that doxxing may violate the PDPO.
 
     Thank you, President.

Ends/Wednesday, January 8, 2020
Issued at HKT 16:55

NNNN