The newly unveiled draft of Hong Kong’s anti-doxxing bill is so broad and vague that it could open the floodgates to arbitrary accusations and leave internet service providers vulnerable to unjustified prosecution, experts and industry leaders have warned.

A day after details of the bill were made public, critics cautioned against forging ahead with what could be one of the toughest anti-doxxing laws in the world.

However, supporters of the bill have argued that Hong Kong is long overdue for tough legislation to counter a problem that went out of control during the anti-government protest chaos two years ago.

Critics on Thursday urged authorities to ensure the new law would not be used to protect the powerful and victimise specific groups such as journalists in an increasingly politicised and polarised environment.

The Legislative Council is expected to pass the bill before its current session ends in October.

The reach of the law remains long and wide, according to Paul Haswell, the head of the technology, media and telecoms practice at global law firm Pinsent Masons.

“Hong Kong has some of the harshest penalties for doxxing in the world, with custodial sentences for those who engage in doxxing even if no harm is actually caused,” Haswell said, assuming the bill would be passed.

“It is also extraterritorial, giving the privacy commissioner the power to issue a notice to remove content, or block access to that content, anywhere in the world.”

The law will empower the Office of the Privacy Commissioner for Personal Data to carry out criminal investigations and initiate prosecutions for doxxing, defined as the practice of maliciously leaking others’ personal information.

Under a two-tier structure of offences, anyone who discloses an individual’s personal data without consent “with an intent to cause specified harm or being reckless” about the harm caused faces a maximum penalty of two years in jail and a fine of HK$100,000 (US$12,875) for each summary conviction.

Under a second-tier indictable offence, the maximum penalty would rise to five years in jail and a fine of HK$1 million.

“Specified harm” includes harassment, molestation, threat, intimidation, bodily harm, psychological harm, harm causing a victim to be concerned about safety and damage to the person’s property.

The commissioner has the authority to apply for a warrant to enter and search premises and seize materials for investigation purposes and even access an electronic device without a warrant. Obstructing or resisting the search or arrest is an offence.

“The penalties are very harsh even for a summary offence while the definitions are very vague. This is really draconian as it could give rise to arbitrary accusations about doxxing,” said Chung Kim-wah, deputy CEO of the Hong Kong Public Opinion Research Institute.

“Take the recent scandal of three top officials attending a dinner as an example. If somebody also revealed the identities of the other unknown guests, will this person be liable for doxxing?”

Chung was referring to customs chief Hermes Tang Yi-hoi, Immigration boss Au Ka-wang and deputy security minister Sonny Au Chi-kwong admitting they attended a hotpot dinner at a luxury clubhouse in March with other businessmen, and had been fined for violating social-distancing rules.

“I don’t think Hong Kong has a very serious issue of doxxing,” Chung said. “It seems the law aims to protect the authorities and officials from being scrutinised by the public, and to suppress freedom of expression.”

However a government spokesman noted on Wednesday that the privacy commissioner had handled more than 5,800 doxxing complaints between June 2019 and last month.

“The public has strongly asked the government to criminalise doxxing acts,” he said.

The government explicitly stated that the law is not meant to target online platform service providers, but the bill still exposes local staff of global tech giants to criminal liability.

Chung Kim-wah, deputy chief executive officer of the Hong Kong Public Opinion Research Institute (PORI), is seen in July 2020.

It quoted the Singapore-based Asia Internet Coalition, which represents tech giants such as Google, Facebook, Twitter, LinkedIn and Yahoo, over the members’ willingness to keep operating in Hong Kong. The Post has contacted the alliance for comment.

The privacy commissioner will be empowered to order internet service providers (ISPs) to take down the offending content, regardless of whether the disclosure is made in Hong Kong or not.

Anyone defying the request without a reasonable defence faces a maximum fine of HK$50,000 (US$6,435) and two years’ jail on the first conviction, and an additional fine of HK$1,000 per day until the material is removed.

“Even if the staff of these companies are found innocent, the accused will still face criminal proceedings. This may not be enough to dispel the fears of the technology providers in Hong Kong,” Haswell said.

Lento Yip Yuk-fai, chairman of the Hong Kong Internet Service Providers Association, said the bill should clearly define “removal of the doxxing content”.

If it meant blocking access to the content, ISPs might need to remove the social media in question.

“For instance, ISPs can remove access to the whole Google search engine or the whole Facebook, but ISPs cannot prohibit access to partial content on Google or Facebook,” he noted.

Pro-establishment lawmaker and barrister Priscilla Leung Mei-fun insisted the penalties were not harsh, saying conviction required a high standard of proof and guilt beyond a reasonable doubt.

“The penalties should be sufficient to deter doxxing acts,” she said. “The privacy commissioner is very fair and they need to prove beyond reasonable doubt a person has committed this offence before he/she could be convicted,” she said.

Leung argued the commissioner needed sufficient powers to deal with doxxing offences or risked being a toothless tiger.

“There might be room for improvement and Legco could still propose amendments to the bill during our future discussions,” she said.

Lokman Tsui, assistant professor of Chinese University’s school of journalism and communication, called on the privacy commissioner to refrain from taking selective enforcement of the law.

“Many journalists have been the victims of doxxing and I hope that the commissioner would be fair in combating doxxing and not be in favour of particular groups of victims,” he said.

The bill, which will amend the Personal Data (Privacy) Ordinance, is expected to be passed before the current legislative session ends in October.