MR CHAN KIN-POR (in Cantonese): Deputy President, I support the Personal Data (Privacy) (Amendment) Bill 2021 (“the Bill”). The purpose of the Bill is to criminalize doxxing acts and empower the Privacy Commissioner for Personal Data (“the Commissioner”) to carry out criminal investigations and institute prosecution in relation to doxxing acts.
At the Commissioner is currently not empowered to combat doxxing acts, she can only write to the online platforms concerned to request the removal of doxxing contents. As the requests are not legally binding, only about 70% of the online platforms are willing to remove such contents. The Commissioner is in fact a toothless tiger because she has to refer any problems to the Police for investigation and to the Department of Justice (“DoJ”) for prosecution. This approach is indeed costly in terms of both time and effort, so it fails to effectively combat doxxing acts. After the legislative amendment, the Commissioner will have criminal investigation and prosecution powers to single-handedly enforce the law, thus greatly speeding up the crackdown and becoming a real tiger again.
Deputy President, doxxing is a cowardly act aimed at silencing the victims, putting them under immense psychological pressure and even threatening their personal safety. Information about their names, residential addresses, telephone numbers, identity cards, vehicle licence numbers, and even family members and children will be fully made public. Once a person’s privacy information is made public, they will be pilloried and intimidated by lawless netizens, and even have their information stolen to borrow money. To cap it all, their children may become targets of bullying at school. The victims will have to live in fear. Moreover, once the information is uploaded onto the Internet, there is no way to remove it completely, which may affect the victims for the rest of their lives. Under the threat of doxxing, those who wish to speak out have no choice but to hold their tongues if they do not want their privacy information to be made public. Therefore, doxxing is definitely an act against freedom of speech. It is a shameful intimidation that has eventually become a tool for “black-clad violence” perpetrators to combat political dissidents.
In fact, from June 2019 to June this year, the Office of the Privacy Commissioner for Personal Data (“PCPD”) received and proactively uncovered over 5 800 doxxing-related cases, of which a large number involved “black-clad violence” perpetrators targeting law enforcement officers and even judges and Legislative Council Members to the extent of lawlessness. PCPD had referred over 1 400 cases to the Police for investigation, and a total of 17 suspects had been arrested by the Police, but only two of the suspects were convicted. Moreover, between November 2019 and April this year, PCPD referred 60 doxxing cases on suspicion of breaching the court’s injunction orders to DoJ. Among these cases, four defendants were convicted. Judging from the figures, the number of doxxing cases has already grown to an intolerable extent, but successful prosecutions are few and far between.
Besides, on Monday, the court imposed a heavy sentence of 45-month imprisonment on a staff member of the Immigration Department (“ImmD”) who repeatedly logged into ImmD’s system to steal the data of 215 government officials, judges, police officers, Legislative Council Members and artistes and provided the data to some doxxing channels for publication. The judge berated the defendant for her behaviour bordering on “cyberterrorism” and describing it as vicious because the leaked information would be circulated permanently, leaving a large number of public officers to suffer from psychological trauma and fear. However, it must be noted that the defendant in this case was duly punished because she was charged with misconduct in public office, which is of significant gravity, rather than an offence related to doxxing. Nevertheless, it is clear from this case that criminalization of doxxing is crucial.
Furthermore, the Bill also requires that the Commissioner be empowered with criminal investigation powers to apply for warrants to search premises and electronic devices, and to stop, search and arrest a person without warrant in urgent circumstances. A two-tier structure will be set up for the offence of doxxing. As some colleagues have already elaborated on this earlier, I will not repeat it. I believe that the adoption of a two-tier structure is necessary. It is an effective approach to set a relatively low conviction threshold for the first tier, because if the threshold is too high, it may not provide adequate deterrence and will eventually become something existing in name only.
In addition, PCPD plans to set up a criminal investigation unit after the legislation is passed. In an interview, the Commissioner said that the manpower requirement would be met by internal redeployment and that if necessary she would consider recruiting people with criminal investigation experience to assist in law enforcement. I believe that PCPD has sufficient powers now, but if there is a lack of experienced people to enforce the law, eventually resulting in failure to arrest suspects or secure convictions, the legislation will likewise exist in name only. Therefore, it is highly advisable for PCPD to directly recruit experienced law enforcement officers. I believe that Members will be happy to approve the funding.
Thank you, Deputy President.