A 31-year-old Chinese Male Arrested for a Suspected Doxxing Offence
Date: 24 March 2023
A 31-year-old Chinese Male Arrested for
a Suspected Doxxing Offence
The Office of the Privacy
Commissioner for Personal Data (PCPD) today arrested a Chinese male
aged 31 in Kowloon. He was suspected to have disclosed the personal
data of a data subject without his consent, in contravention of
section 64(3A) of the Personal Data (Privacy) Ordinance (PDPO).
The investigation revealed that the victim and the arrested
person once were intimate friends. Their relationship turned sour in
early 2022. Thereafter, a total of four posts containing the victim’s
personal data, some with negative comments on the victim, were
published on two social media platforms between July and December
2022. The personal data disclosed included the victim’s Chinese name,
English name, Hong Kong Identity Card (HKID card) number, mobile phone
number, gender, age, photos, medical report and a partly redacted copy
of the victim’s HKID card.
The arrested person is granted
bail. The PCPD will continue its investigation into the case.
The PCPD reminds members of the public that doxxing is a
serious offence. An offender is liable on conviction to a fine up to
$1,000,000 and imprisonment for 5 years. The PDPO applies equally to
the online world. To avoid breaking the law, members of the public
should think twice before publishing or forwarding any doxxing
messages on the internet or social media platforms.
Relevant Provisions under the PDPO
Pursuant to
section 64(3A) of the PDPO, a person commits an offence if the person
discloses any personal data of a data subject without the relevant
consent of the data subject—
(a) with an intent to cause any
specified harm to the data subject or any family member of the data
subject; or
(b) being reckless as to whether any specified
harm would be, or would likely be, caused to the data subject or any
family member of the data subject.
A person who commits an
offence under section 64(3A) is liable on conviction to a fine of
$100,000 and imprisonment for 2 years.
Pursuant to section
64(3C) of the PDPO, a person commits an offence if—
(a) the
person discloses any personal data of a data subject without the
relevant consent of the data subject—
(i) with an intent to
cause any specified harm to the data subject or any family member of
the data subject; or
(ii) being reckless as to whether any
specified harm would be, or would likely be, caused to the data
subject or any family member of the data subject; and
(b) the
disclosure causes any specified harm to the data subject or any family
member of the data subject.
A person who commits an offence
under section 64(3C) is liable on conviction on indictment to a fine
of $1,000,000 and imprisonment for 5 years.
According to
section 64(6) of the PDPO, specified harm in relation to a person
means—
(a) harassment, molestation, pestering, threat or
intimidation to the person;
(b) bodily harm or psychological
harm to the person;
(c) harm causing the person reasonably
to be concerned for the person’s safety or well-being; or
(d) damage to the property of the person. －End－