Recent Proposed amendments to the Personal Data (Privacy) Ordinance

In May 2021, a discussion paper[1] (the “Paper”) was published whereby amendments were proposed to the Personal Data (Privacy) Ordinance (Cap. 486) (the “PDPO”) in order to combat doxxing acts. Doxxing acts generally refer to the act of revealing information about an individual online, such as their true name, photograph, occupation, work or residential address, phone number, etc.. Such information is then circulated to the public without the data subject’s prior consent.

The amendments proposed in the Paper include:-

1. Creating a “doxxing” offence under section 64 of the PDPO. The Paper suggests to create an offence in the PDPO such that a person shall commit a criminal offence if he/she discloses any personal data of an individual (the “data subject”) without his/her consent, (i) with an intent to threaten or harass the data subject or any of his/her immediate family member; or (ii) with an intent to cause psychological harm to the data subject or any of his/her immediate family member; and that act of disclosure causes psychological harm to the data subject or any immediate family member.

2. Conferring statutory powers to the Privacy Commissioner for Personal Data (the “Commissioner”) to demand the rectification of doxxing contents. The Paper suggests that provisions shall be added to the PDPO in order to empower the Commissioner to serve a rectification notice to any person for rectification action of doxxing contents. The rectification notice shall specify what rectification actions to be taken, as well as the deadline for compliance, etc. The Paper also suggests that a rectification notice may be served to any person or entity which provides services in Hong Kong to Hong Kong residents. If the person who receives the rectification notice cannot comply with the request within the designated timeframe, that person may commit an offence, unless he/she has a reasonable excuse of not following the requests specified in a rectification notice.

If these amendments are to be adopted and implemented, internet service providers (in particular, any internet forum that provides services in Hong Kong) will need to beware of any potential criminal liability for non-compliance with any rectification notice as may be issued by the Commissioner. It is not clear from the Paper whether the non-compliance with any rectification notice by the Commissioner is a strict liability offence, and also, what constitutes a “reasonable excuse”. It is also not clear from the Paper whether a failure to receive a ratification notice by the Commissioner shall be constitute a “reasonable excuse” for non-compliance.

Further, given internet providers appear to be required to comply with the Commissioner’s rectification notice before anyone is convicted under the “doxxing” offence under section 64 of the PDPO, it will be interesting to see how the proposed criminal offence under section 64 of PDPO interacts with the right of freedom of speech as guaranteed under Article 27 of the Basic Law.

For more information, please contact our lawyer Emily Cheung at emily.cheung@haldanes.com.

This article is for information purposes only. Its contents do not constitute legal advice and readers should not regard this article as a substitute for detailed advice in individual instances.

[1] LC Paper No. CB(4)974/20-21(03) – https://www.pcpd.org.hk/english/whatsnew/files/ca20210517cb4_974_3_e.pdf