RegStream

The Office of the Privacy Commissioner for Personal Data (PCPD) held a media briefing today to elaborate on the PCPD’s concern on the placing of “blind” recruitment advertisements (Blind Ads) on online recruitment platforms, as well as to report on its enforcement work in the past three years since the commencement of the provisions criminalising doxxing acts under the Personal Data (Privacy) Ordinance (PDPO).

1. Investigations on the Placing of Blind Ads on Online Recruitment Platforms

Between September 2021 and August 2024, the PCPD received 57 enquiries and 11 complaints in relation to recruitment advertisements. The PCPD noticed that there were organisations placing Blind Ads on online recruitment platforms. In general, a Blind Ad is one that does not identify the recruiting organisation nor contain sufficient information to identify the organisation, and does not provide a means for job applicants to make further enquiries or such means does not contain sufficient information to identify the organisation, but directly invites job applicants to submit their personal data, such as their Hong Kong Identity Card numbers, contact details or resumes.

In view of this, from June to September 2024, the PCPD reviewed 22,270 recruitment advertisements across 13 online recruitment platforms, and 23 Blind Ads were found. The PCPD is concerned that the act of placing Blind Ads to collect personal data from job applicants may constitute a contravention of the relevant requirements under the PDPO. With a view to protecting the personal data privacy of members of the public, the PCPD has proactively initiated investigations against five organisations that had placed Blind Ads.

The Privacy Commissioner for Personal Data (Privacy Commissioner), Ms Ada CHUNG Lai-ling, appeals to job seekers to stay vigilant about Blind Ads. She pointed out, “Blind Ads may be used as an unscrupulous means to collect personal data and may be misused by swindlers to collect personal data for fraudulent activities. When job seekers are unable to ascertain the employers’ identities, they should check and verify the information contained in the Blind Ads carefully and should not respond to the Blind Ads arbitrarily and submit their personal data. ” 

With regard to the collection of personal data, Data Protection Principle (DPP) 1(2) of the PDPO requires that personal data shall be collected by means which are lawful and fair in the circumstances of the case. DPP 1(3) provides that organisations must take all practicable steps to notify the data subjects on or before the collection of the data the purpose of data collection, the classes of persons to whom the data may be transferred, whether it is obligatory or voluntary for the data subjects to supply the data and the consequences for the data subjects if the data subjects fail to supply the data, etc.

In order to protect the job applicants’ personal data and project positive corporate image, the PCPD appeals to employers to:

Increase transparency in placing recruitment advertisements and disclose the identities of the organisations;

Refrain from placing Blind Ads to collect job applicants’ personal data; and

If necessary, consider engaging a recruitment agency who is identified in the advertisement to collect the personal data from job applicants.

As Blind Ads may constitute a contravention of the PDPO and may be used by swindlers to collect personal data for fraudulent activities, the PCPD urges recruitment platforms to:

Beware of anyone using Blind Ads to perpetrate frauds or collect personal data by unfair means; and

Carefully review recruitment advertisements to identify Blind Ads and avoid publishing the same in order to protect the personal data privacy of members of the public.

For members of the public who wish to make any enquiries or lodge any complaint against the placing of Blind Ads, please contact the PCPD (telephone: 2827 2827 or email: communications@pcpd. org. hk/complaints@pcpd. org. hk).

2. Online Doxxing Messages Dropped by 90% on Third Anniversary of Anti-Doxxing Law

The provisions criminalising doxxing acts under the PDPO came into effect on 8 October 2021. The amendments empower the Privacy Commissioner to carry out criminal investigations, institute prosecutions for doxxing-related offences and issue cessation notices to request the cessation of disclosure of doxxing messages.

From the effective date (8 October 2021) of the relevant provisions up to 31 August 2024, the PCPD handled a total of 3,234 doxxing cases, including 1,586 doxxing-related complaints and 1,648 doxxing cases uncovered by the PCPD’s proactive online patrols. The PCPD also issued a total of 2,032 cessation notices to 46 online platforms to request the removal of 33,494 doxxing messages, with a compliance rate of over 96%. Other than individual doxxing messages, 249 doxxing channels were successfully removed by cessation notices.

From the effective date (8 October 2021) of the relevant provisions up to 31 August 2024, the PCPD initiated 363 criminal investigations, and 88 cases were referred to the Police for further follow-up actions. As regards arrest operations, the PCPD mounted a total of 58 arrest operations (including three arrests made as joint operations with the Police). A total of 59 suspects were arrested. During the period, 37 prosecutions were made in respect of doxxing cases and there were 26 convictions.

Enforcement Work to Combat Doxxing

In the first eight months of 2024, the number of doxxing cases uncovered by the PCPD’s proactive online patrols was 80, representing a significant drop of 90% when compared to 803 cases during the same period in 2022 (i. e. the same period of the first year after the commencement of the anti-doxxing provisions). 270 doxxing-related complaints were received by the PCPD in the first eight months of 2024, which represented a drop of close to 40% (36%) when compared to the 421 complaints received during the same period in 2022.

Publicity and Education Work to Combat Doxxing

To combat doxxing acts, the PCPD launched a series of publicity and education campaigns to enhance the public’s awareness of the new doxxing offences and promote compliance. These included launching a thematic website on “Doxxing Offences”, issuing an implementation guideline, broadcasting short videos and television and radio announcements, distributing promotional leaflets and posters, publishing two new books titled “The Treasure-trove of Privacy – Understanding Your Personal Data Privacy

” and “Personal Data (Privacy) Law in Hong Kong – A Practical Guide on Compliance (Third Edition)

”, which included dedicated chapters on the new doxxing offences,  organising seminars/webinars and promoting the new provisions on social media platforms. By the end of August 2024, the Privacy Commissioner and the PCPD personnel conducted 104 webinars/seminars concerning the new anti-doxxing regime, with the number of participants reaching 22,000. To raise the awareness of secondary school students about the seriousness of cyberbullying and doxxing offences, the PCPD has in particular organised the School Touring of Anti-doxxing Education Talks to promote relevant information to secondary school students at schools. By the end of August 2024, the PCPD visited 50 secondary schools and held anti- doxxing education talks for over 17,000 students.

The Privacy Commissioner, Ms Ada CHUNG Lai-ling, said, “The PCPD’s ongoing enforcement actions, publicity and education work, coupled with a more congenial atmosphere in the society, have resulted in a significant decrease in the number of doxxing cases found on the internet every year since the commencement of the anti-doxxing provisions in 2021. For the past year, the main reasons for doxxing the victims were monetary disputes (e. g. non-payment of debts and contractual disputes, accounting for 42%) and personal relationship disputes (e. g. relationship disputes and neighbourhood disputes, accounting for 31%). There has been a significant decrease in the number of doxxing cases which arose from differences in political opinions (accounting for 2%). ”

The Privacy Commissioner also stated, “It is clear that the PCPD’s work on combatting doxxing acts has not affected the freedom of speech of members of the public, nor has it affected the lawful operation of online platforms in Hong Kong. The PCPD will continue to take resolute enforcement actions against doxxing acts to ensure that the personal data privacy of the public is adequately protected. ”

The Privacy Commissioner, Ms Ada CHUNG Lai-ling, appealed to job seekers to stay vigilant about “blind” recruitment advertisements.

The Privacy Commissioner, Ms Ada CHUNG Lai- ling (middle), Senior Legal Counsel, Ms Hermina NG Wing-hin (left) and Senior Personal Data Officer (Criminal Investigation), Mr Lo Dik-fan (right), at the media briefing.