Can one be convicted of doxxing in Hong Kong?
Our Partner Rosita Li and Trainee Solicitor David Cheung wrote an article about doxxing in Hong Kong. Doxxing has become increasingly widespread since the beginning of the social events in June 2019. It refers to the searching and disseminating of personal information about others without their prior consent.
It is anticipated that amendments will be made to the Personal Data (Privacy) Ordinance to criminalize doxxing within the current legislative year. While there is currently no express legislation dealing with doxxing, doxxers may still be sentenced to imprisonment.
We have summarized some recent cases and highlighted the relevant sections in the Crimes Ordinance and Personal Data (Privacy) Ordinance which relates to the sanctioning of doxxing activities.
You may read the full article below.
Can one be convicted of doxxing in Hong Kong?
Since the beginning of the social events in June 2019 in Hong Kong, doxxing has become increasingly widespread.
Doxxing is a term used to describe the act of searching and gathering personal information of another individual (or his/her family) and subsequently, without the consent of the person(s) involved, disclosing or publishing such personal information on the internet, social media or other open platforms with the malicious intent to humiliate or intimidate, cause or likely to cause psychological or bodily harm to the victims.
The Chief Executive said recently that doxxing should be made a criminal offence and The Constitutional and Mainland Affairs Bureau and Office of the Privacy Commissioner for Personal Data are making preparations to amend the Personal Data (Privacy) Ordinance to criminalize doxxing. The amendment will also empower the privacy commissioner to investigate and prosecute cases, and to order online platforms to remove doxxing content. It is estimated that the drafting work will be completed within the current legislative year.
While there is currently no express legislation dealing with doxxing, it does not mean that there is no legal liability for doxxing someone. Doxxers may still be sentenced to imprisonment under the current laws.
HKSAR v Chan King-Hei  HKDC 1020
In this case, the defendant, Chan King-hei (“Chan”), was the first to be criminally convicted and sentenced for two years in jail in Hong Kong for doxxing during the social events.
Chan, who was employed by Hong Kong telecommunications (“HKT”) as a Network Service Officer at the material time, downloaded personal information from HKT’s database and stored them in the computer he used in the course of employment. Chan later shared such personal information on Telegram.
Among other offences, Chan was charged under (a) Section 161 of the Crimes Ordinance (Cap. 200) (“CO”) for obtaining access to a computer with a view to dishonest gain for himself or another and (b) Section 64 of the Personal (Data) Privacy Ordinance (Cap. 486) (“PDPO”) for disclosing personal data obtained without consent from data users and causing harm (including psychological harm) to the victim.
Section 64 of the PDPO
Section 64 of the PDPO provides that one commits an offence if he or she discloses personal data of a data subject which was obtained from a data user without the data user’s consent, with an intent to obtain a gain or cause a loss, or which causes psychological harm to the individual. Intent to cause psychological harm does not need to be shown. The offence carries a penalty of five years’ imprisonment and a fine of HK$1 million.
At the trial in November 2020, the District Court judge found that by obtaining the personal information of three public figures, 20 police officers and six of their family members and to record 63 addresses through HKT’s database without the company’s authorization and disclosing them to the public through Telegram, Chan had committed an offence. Psychological harm was ultimately caused to the victim, namely a police officer’s father, due to the information being circulated on the internet, causing concerns over personal safety of his family members and to himself. Such distress was supported by psychological reports showing that the victim had shown significant changes in emotions and actions in the course of several months after such personal information was disclosed. Chan was sentenced to 18 months for breach of Section 64 of the PDPO.
Section 161 of the CO
Under Section 161 of the CO, Chan was found guilty for obtaining access to HKT’s computer with a view to dishonest gain for himself or another, or with a dishonest intent to cause loss to another.
The Court applied the judgement of HKSAR v Au Yeung Ka Man  HKCFA 23 and emphasized that the intended gain on Chan’s part need not specifically involve a “gain or loss in money or other property”. It could extend to “any such gain or loss”, including “information which the person obtaining access to the computer did not have before the access.” According to evidence given by the Engineering Manager of HKT at trial, Chan’s act of searching, accessing, storing and disclosure of information without authorization was not only prohibited under HKT’s policy, but was also not needed by Chan to carry out his duties at work. Therefore, in breach of the Confidentiality / Intellectual Property Undertaking Chan had signed with HKT, Chan accessed the information that he couldn’t prior to becoming HKT’s employee, thus satisfying the intended gain. By accessing the HKT’s database he knew he was not authorized to for the purposes of acquiring personal data of others for his own purposes and without their consent, Chan had satisfied dishonest intent. It was held that any reasonable and honest person, viewing from both an objective and subjective standpoint, would find that the Chan’s act amounted to dishonesty.
In the case of Secretary for Justice v Cheng Ka Yee and others  HKCFA 9, the Court of Appeal emphasized that Section 161 only applies in situations where the doxxer uses another’s computer to engage in doxxing activities. If the doxxer uses his own computer, Section 161 of the CO would not be applicable, as the actus reus for the offence would only be satisfied if it involves the obtainment of information from another person’s computer.
Two reporters from Next Magazine, who allegedly acquired and published birth certificate details of the youngest son of actress, Cecilia Cheung, in 2019, have recently been prosecuted. One was charged for disclosing personal data without user consent. Another was charged for alleged conspiracy to disclose personal data obtained without user consent under the Personal Data (Privacy) Ordinance.
According to the local reports, the two reporters gained access to the birth certificate of Cheung’s youngest son, by searching records under the Immigration Department and then published the details in January 2019. There are no further updates on the case yet, but it will be interesting to see how the Court handles it.
Searching and disseminating personal information about others without their prior consent could lead to serious consequences. It is clear that before doxxing activities are criminalized, section 64 of the PDPO or section 161 of the CO can be used to sanction doxxing behavior and doxxers can face imprisonment.
 The Undertaking in the employment agreement states that Chan would “not disclose, make use of, divulge or communicate to any person (save in the proper performance of [his] duties under the contract of employment)…other confidential or privileged information of or relating to [HKT]…which [the Defendant] receive[d] or obtain[ed] while in the employment of [HKT].”
If you would like to know more about this topic, please contact our Partner, Ms. Rosita Li (email: [email protected]), or our Trainee Solicitor, Mr. David Cheung (email: [email protected]) for more information.