Cybersecurity & Data Protection Update 2021

20 August 2021 | by LexisNexis Hong Kong

The Constitutional and Mainland Affairs Bureau published a discussion paper (the "Paper”) on proposed amendments to the Personal Data (Privacy) Ordinance (“PDPO”) to combat doxxing acts in May 2021.

Doxxing is an act of disclosing personal information online about an individual, such as their name, photograph, phone number and residential address without the consent of the relevant data subject, typically with malicious intent.

The Paper focuses on three key amendments to the PDPO:

1. Introducing an offence to curb doxxing acts

   The proposal creates a criminal offence under section 64, where a person discloses any personal data of a data subject without the data subject’s consent with an intent to threaten, intimidate, harass, or cause psychological harm to the data subject or any of his or her immediate family member. An individual may face a fine of up to HK$1m and imprisonment of 5 years.

2. Empowering the Commissioner to carry out criminal investigation and prosecution

   The Paper proposes to introduce new provisions to empower the Privacy Commissioner for Personal Data (the “Commissioner”) to carry out criminal investigation and initiate prosecution for the first time. Currently, these powers are available to the Hong Kong Police Force (the “Police”) and the Department of Justice (the “DoJ”).

   Under the proposal, the Commissioner may:

   • request relevant information, documents or things from any person, or require any person to answer questions to facilitate investigation upon the Commissioner’s reasonable grounds to believe there has been a violation of section 64 of the PDPO;
   • apply for the court’s permission to enter any premises when investigating the doxxing offence, which may include seizure of documents or other property; and
   • prosecute in its own name or refer cases to the Police or the DoJ for follow up actions.
3. Conferring on the Commissioner statutory powers to demand the rectification of doxxing content

The proposed amendments empower the Commissioner to serve a Rectification Notice to any person who provides services in Hong Kong to Hong Kong residents, directing the relevant online platform to rectify the doxxing content. The Commissioner will specify in the Rectification Notice the concerned doxxing content, notify the person what rectification actions to take, and set forth the deadline for compliance with the notice.

An appeal mechanism against a Rectification Notice permits any person affected by the notice to appeal, but no longer than 14 days after the notice was served.

The proposal also empowers the Commissioner to apply to the court for an injunction if he or she is satisfied that there is or it is very likely that there is a large-scaled or repeated contraventions of section 64 of the PDPO.

The Lexis Insights articles are provided for reference purposes only and are not intended, nor should they be used, as a substitute for professional advice or judgment or to provide legal advice with respect to specific circumstances. If you require any legal advice or other expert assistance, please consult a competent professional adviser.

For enquiries about the following publications, please contact your Account Manager via marketing.hk@lexisnexis.com