Hong Kong defends internet privacy abuse law

Hong Kong privacy officials have defended controversial new laws against doxxing – malicious publication of people’s personal details such as addresses and phone numbers on the internet.

Since anti-extradition protests erupted in Hong Kong in June 2019, police officers and judges, among others, have become the target of privacy infringements.

As most social media platforms have their servers outside Hong Kong, police have failed to get information from them to trace the origins of the posts.

However moves to tighten the law have run into opposition from the Singapore-based Asia Internet Coalition (AIC). On June 26, the AIC, an industry association with members including Facebook, Google and Twitter, submitted a letter to the Office of the Privacy Commissioner for Personal Data (PCPD) asking for a meeting to talk about the law amendments.

It said “any anti-doxxing legislation, which can have the effect of curtailing free expression, must be built upon principles of necessity and proportionality.”

It warned of potential sanctions against technology companies in the amendments. The only way these companies could avoid sanctions would be to refrain from investing and offering their services in Hong Kong, thereby depriving Hong Kong businesses and consumers while creating new barriers to trade.

However, Privacy Commissioner Ada Chung Lai-ling said in an interview with Commercial Radio on Monday that the Office of the PCPD strongly opposed the comments that the proposed laws would affect foreign companies’ investments in Hong Kong.

The laws would only target illegal doxxing acts while the PCPD’s law enforcement power would also be stated clearly.

Chung said the Office welcomed public opinions about the amendments and would soon meet AIC representatives. She said other jurisdictions including Australia, New Zealand and Singapore had similar anti-doxxing laws while their scopes were much broader than those proposed by Hong Kong.

On May 17, the PCPD submitted a paper to the Legislative Council Panel on Constitutional Affairs on the proposed amendments to the Personal Data (Privacy) Ordinance.

It said between June 2019 and April 2021, the PCPD had referred more than 1,460 cases which involved suspected contravention of section 64(2) of the Ordinance to the police for criminal investigation and consideration of prosecution. It said 17 suspects had been arrested for suspected contravention of the Ordinance and two had been convicted.

“At present, the personal data involved in most doxxing cases was recklessly dispensed and repeatedly reposted on online platforms, making it impossible for the PCPD to trace the sources of the doxxing contents and ascertain the identity of the data users concerned or whether the personal data concerned was obtained from the data user without the data user’s consent,” said the PCPD.

The PCPD said it proposed to add new provisions to empower the Privacy Commissioner to carry out criminal investigation.

It said the Commissioner should have the power to request relevant information, documents or things from any person, or require any person to answer relevant questions to facilitate investigation when the Commissioner has reasonable grounds to believe that a contravention of section 64 of the PDPO has been, or is being, committed.

Any person who contravenes the doxxing law would be liable on conviction on indictment to a fine of HK$1 million (US$128,756) and to imprisonment for 5 years, or on summary conviction to a fine of HK$100,000 and to imprisonment for 2 years, it said.

Threat to quit

The AIC letter added, “The scope of any restrictions on content and free expression should be clearly defined so that both intermediaries and users can better understand the aim, impact, and application of these regulations, as well as to avoid any inadvertent or unintended violations.”

It said there was no universally accepted definition of doxxing.

“The usage of the terms ‘any persons’ and ‘any premises’ in the proposed amendments suggested that intermediaries and their local subsidiaries would be within scope for investigation and prosecution under the proposed amendment, said the AIC. “We respectfully disagree with this expansive scope.”

The letter did not make a lot of noise until the Wall Street Journal said in a Monday report that Facebook, Twitter and Google had privately warned the Hong Kong government that they could stop offering their services in the city.

It said representatives for the three firms declined to comment on the letter. On Monday, the AIC posted the letter on its website.

On May 7, 2019, the Parliament of Singapore passed an amendment to its Protection from Harassment Act.

This added a new offence of doxxing, which involves the publication of “identity information” to harass, threaten, or facilitate violence against the victim. Penalties for the offences, including publishing personal information to cause the fear of violence or facilitate the use of violence, are a fine of up to S$5,000 (US$3,718) and/or up to 12 months’ jail for a first conviction. The penalties are doubled for repeat offenders.

A Singapore government agency website illustrates the laws with examples of how a person would violate the doxxing laws. It said a person would be guilty if he or she posted the home address of another person who was being targeted in a threatening post on social media.

People’s concerns 

On Tuesday, Chief Executive Carrie Lam said people’s anxieties over the anti-doxxing legislation would fade in time. Lam said the law would only target illegal doxxing behaviour and empower the privacy commissioner to take action.

“Every piece of legislation, including the National Security Law, will cause some concerns and anxiety. Of course it’d be great if these concerns can be addressed as much as possible during the legislation process,” she said.

“But sometimes we have to let the facts speak for themselves. The National Security Law in Hong Kong has been implemented for a year… and things people who smeared the law earlier said would happen had not happened.”

She added there was general support in society for measures to combat doxxing as the problem has “caused trauma to a lot of people for a long time.”

Some Hong Kong netizens fear they will no longer be able to use their social media or Gmail accounts domestically but an information technology expert said people should not be over-worried.

Wong Ho-wa, a member of the Information Technology Subsector of the Election Committee, said people in Hong Kong would continue to be able to use the services provided by Google, Facebook and WhatsApp as these companies operated their servers overseas.

Wong said even if these companies dismissed their Hong Kong offices, which were set up mainly for sales and marketing, it would not affect Hong Kong users.

However, Wong said the incident could be an alarm for Hong Kong as international IT firms had expressed their concerns about the operational risks in the city.

Read: Hong Kong leader dismisses privacy law fears

Hong Kong’s anniversary disrupted by police knifing