Privacy Commissioner’s Office Laid Charges in a Doxxing Case

The Office of the Privacy Commissioner for Personal Data (PCPD) today laid a total of seven charges against a Chinese male aged 26 (defendant) for "disclosing personal data without consent", contrary to section 64(3A) of the Personal Data (Privacy) Ordinance (PDPO). The case will have its first mention at the Shatin Magistrates' Court in the afternoon of 25 August 2022. The defendant is presently on bail.

This is the second time charges were laid under the new anti-doxxing regime, which came into operation in October 2021.

Background of the case

The investigation suggests that the defendant and the complainant had a short relationship before breaking up. Between 19 and 26 October 2021, the defendant was suspected to have disclosed on four social media platforms the complainant's personal data, including her name, photos, residential address, private and office telephone numbers, name of her employer and position. The defendant was also suspected to have impersonated the complainant to open accounts on three of the said platforms. The defendant was suspected to have stated in the relevant messages that the complainant welcomed others to visit her at her address. Many strangers later contacted the complainant and tried to get acquainted with her. The PCPD arrested the defendant on 22 June 2022.

Relevant provisions of the PDPO

Pursuant to section 64(3A) of the PDPO, a person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject-

A person who commits an offence under section 64(3A) is liable on conviction to a fine of $100,000 and imprisonment for 2 years.

According to section 64(6) of the PDPO, specified harm in relation to a person means-