OVERVIEW
The anti-doxxing provisions under section 64 of the Personal Data (Privacy) Ordinance (Cap. 486) were strengthened to curb the weaponization of personal information online. The law targets the malicious practice of disclosing personal data without consent—commonly known as doxxing—where an individual's private data, such as a home address, phone number, identity card number or family details, is disseminated through social media networks, chat groups or online forums to incite harassment or cause other specified harm.
The Office of the Privacy Commissioner for Personal Data (PCPD) has statutory powers to investigate suspected doxxing offences, require the cessation of disclosure through cessation notices, and conduct prosecutions in cases within its statutory authority.
STATUTORY PROVISIONS
section 64 of the Personal Data (Privacy) Ordinance (Cap. 486)
The relevant part of the current statutory provision states:
Section 64 — Doxxing-related offences
The section creates offences concerning disclosure of personal data without the data subject's relevant consent where the prescribed intent or recklessness concerning specified harm is proved. A more serious offence applies where specified harm is caused.
ELEMENTS OF THE OFFENCE
Section 64 creates a two-tier system of criminal doxxing offences, distinguished by whether the disclosure actually causes specified harm to the data subject or a family member. The prosecution must prove every element of the charged offence beyond a reasonable doubt.
Tier 1: The Basic Doxxing Offence — Section 64(3A)
The prosecution must prove:
- Disclosure: The defendant disclosed personal data of a data subject.
- Absence of consent: The disclosure was made without the relevant consent of the data subject.
- Intent or recklessness: The defendant intended to cause specified harm to the data subject or any family member, or was reckless as to whether specified harm would be, or would likely be, caused to the data subject or any family member.
Tier 2: The Aggravated Doxxing Offence — Section 64(3C)
The prosecution must prove all the elements of the Tier 1 offence and one additional physical consequence:
- Resulting harm: The disclosure actually caused specified harm to the data subject or any family member.
Under section 64(6), specified harm is defined to cover the following forms of harm:
- Harassment, molestation, pestering, threat or intimidation to the person.
- Bodily harm or psychological harm to the person.
- Harm causing the person reasonably to be concerned for the person's safety or well-being.
- Damage to the property of the person.
Maximum Penalty
- Tier 1 — Basic offence (intent or recklessness as to specified harm): Under section 64(3B), the maximum penalty is 2 years' imprisonment and a HK$100,000 fine.
- Tier 2 — Aggravated offence (actual specified harm caused): Under section 64(3D), the maximum penalty on conviction on indictment is 5 years' imprisonment and a HK$1,000,000 fine.
HOW MCS CAN ASSIST
Advice and representation
MCS can assess the charge, the statutory elements and the prosecution evidence; advise on interview, plea, trial and sentence; and identify any defence or evidential issue available on the facts.