Hong Kong’s controversial new anti-doxxing law, which criminalizes the non-consensual disclosure of individuals’ sensitive personal data, has come into effect despite opposition from both technology firms and privacy advocates.
Effective today (October 8), the law gives the regional government’s privacy watchdog powers to prosecute doxxing-related offences, with offenders potentially liable for jail terms of up to five years and fines of up to HK$1 million (US$128,200).
“Anyone who discloses the personal data of another person without consent, whether recklessly or with intent to cause specified harm to the person or his or her family, such as harassment, molestation, pestering, threat, intimidation, bodily or psychological harm or damage to property, commits the offence of doxxing,” said the Office of the Privacy Commissioner for Personal Data (PCPD), the domestic data protection regulator.
The harshest penalties are imposed if victims suffer harassment, intimidation, physical or psychological harm, damage to their property, or a threat to their safety or wellbeing.
The law, an amendment (PDF) to the Personal Data (Privacy) Ordinance 2021, was passed by Hong Kong’s legislature on September 29.
Pro-democracy protests
The amendment was drafted in the wake of a surge in doxxing-related incidents during pro-democracy protests that convulsed the special administrative region (SAR) in 2019, as reported by The Daily Swig in January 2020.
Sparked by a controversial treaty that enabled the extradition of criminal suspects to mainland China, the protests saw numerous demonstrators investigated for sharing photos and other personal data online of what protestors claimed were rogue police officers.
Police officers were themselves accused of doxxing too, with two reported instances involving the live streaming of videos in which journalists’ identity cards were visible.
The PCPD says it has handled more than 5,800 doxxing cases between the very first report in June 2019 and the end of June 2021, and has detailed a number of convictions under the previous legal framework.
‘Not aligned with global norms’
The PCPD is also empowered to conduct searches on online service providers’ electronic equipment, order arrests without a warrant, and request that content be removed from websites hosted outside Hong Kong. Failure to comply could see local representatives face up to HK$100,000 in fines and two years’ imprisonment.
These provisions have provoked alarm among tech firms, which fear staff could be exposed to the risk of prosecution over the publication of user-submitted content.
The Asia Internet Coalition (AIC), a Singapore-based trade association that represents Apple, Facebook, Google, LinkedIn, Twitter, and Amazon, explained its concerns in a letter sent to the Hong Kong government in June.
“Introducing sanctions aimed at individuals is not aligned with global norms and trends,” it said, warning that technology companies might be tempted to “refrain from investing and offering their services in Hong Kong” as a result.
Having criticized a National Security Law passed in 2020 for curtailing freedom of speech and protest, human rights and pro-democracy groups are similarly concerned the anti-doxxing legislation is yet another tool for stifling dissent.
‘Clear, focused and target-specific’
However, a government spokesperson said “the scope of the offence is clear, focused and target-specific. The amendments also strike a reasonable balance between protection of privacy and freedom of speech”.
Lawmakers proposed additional, GDPR-like amendments to Hong Kong’s 1996 privacy law in January 2020, including a mandatory data breach notification mechanism, associated stiff penalties, and additional data privacy safeguards.
However, the amendment bill enacted today focuses exclusively on doxxing.
Source: https://portswigger.net/daily-swig/hong-kongs-anti-doxxing-law-comes-into-force-despite-human-rights-criticism
