Hong Kong authorities have agreed to lower the threshold for defining the crime of doxxing, removing a requirement that prosecutors prove victims suffered psychological harm.
With the lowering of the threshold, revealed on Wednesday, the mere act of deliberately leaking an individual’s personal information with the intent to threaten or harass them or their family will be punishable by two years behind bars and a maximum fine of HK$100,000 (US$12,877).
The tweaks to the proposed amendments to the city’s privacy law were made after pro-establishment lawmakers said it would be too difficult to require that victims prove actual psychological harm for a criminal to face justice. In cases where such harm was proved, however, the maximum penalty would rise to five years in jail and a fine of HK$1 million.
Under the latest changes, the government also specified that only the managers of internet service providers, or executives with the capability to remove online materials, could be ordered by the privacy commissioner to take down doxxing information.
A previous proposal had suggested that any staff member of a relevant tech company could face legal consequences for failing to comply with such an order, sparking an outcry from the Singapore-based Asia Internet Coalition, an alliance that includes such American tech giants as Facebook, Google, Yahoo, Twitter and LinkedIn.
Pro-establishment legislator Priscilla Leung Mei-fun welcomed the latest adjustments, and said she hoped the bill could be approved soon.
“The government has responded to the concerns from both my colleagues and the tech firms,” she said. “Some people might be stronger psychologically, and wouldn’t be easily harmed by doxxing. But someone with a malicious intention to leak another person’s information should still be prosecuted.”
Earlier this month, Chief Executive Carrie Lam Cheng Yuet-ngor had moved to allay fears raised by American tech companies over the planned anti-doxxing law, saying the implementation of the legislation would prove its effectiveness and ease their concerns.
The Personal Data (Privacy) (Amendment) Bill 2021 is set to be gazetted on Friday. It will be officially tabled in the Legislative Council for a first and second reading on Wednesday next week.
Lawmakers are expected to establish a bills committee to scrutinise the legislation in greater detail before putting it to a vote before the full council ahead of the end of the current legislative session in October.
Under the government’s original plan, authorities would have needed to prove that a suspect had deliberately leaked information without the consent of the victim and had caused actual harm in order to secure a conviction.
But in a Legco meeting in May, lawmakers said that threshold was too high, prompting the government to add the lesser offence, under which a suspect could be convicted as long as he had the intention of hurting or harassing the victim of the data leak.
Pro-establishment lawmaker Holden Chow Ho-ding said the new two-tier model would make the law more deterrent.
“I welcome the removal of the requirement to prove psychological harm to victims … It was too difficult to be proved and criminals could be acquitted under such a loophole,” he said.
In a statement, a government spokesman noted that the Office of the Privacy Commissioner for Personal Data had handled more than 5,800 doxxing complaints between June 2019 – when long-running anti-government protests kicked off – and last month.
“The public has strongly asked the government to criminalise doxxing acts,” he said.
The spokesman added that while drafting the bill, the government made reference to relevant laws in countries such as Singapore, New Zealand and Australia, and took into account Hong Kong’s actual circumstances.
He also noted that the Asia Internet Coalition had clarified that none of its members currently had plans to retreat from Hong Kong because of the legislation.
“The [coalition] also shared the view that doxxing is a serious matter, and that doxxing acts have to be curbed to protect personal data privacy,” he added.