Anti-doxxing regime

VII. Anti-doxxing regime

In general, doxxing refers to the gathering of the personal data of target persons and/or related persons (such as their family members, relatives and friends) through online search engines, social media, discussion forums, public registers, anonymous reports etc., followed by disclosure of the same on the Internet, social media and/or other open platforms (such as public places).

Doxxing acts become more rampant in recent years. Following the passing of the Personal Data (Privacy) (Amendment) Bill 2021 on 29 September 2021, the amended provisions of the Ordinance targeted on doxxing took effect on 8 October 2021 to combat malicious doxxing acts.

In summary, the amended Ordinance aims to combat unlawful doxxing acts in three aspects:

• criminalising doxxing acts as new offences targeting malicious acts of disclosing personal data of the data subject without his/her consent, with an intent or being reckless as to whether specified harm would be caused to the data subject or his/her family member;

• empowering the PCPD to carry out criminal investigations and institute prosecution towards doxxing-related offences; and
• conferring on the PCPD statutory powers to serve notices to those who are able to take a cessation action, directing them to cease disclosure of doxxing contents (cessation notices).