The government is planning to change these laws to curb doxxing, after police officers and judges, among others, became targets of privacy infringement since the start of the 2019 protests.
It proposed a maximum fine of HK$1 million and imprisonment of up to five years for offenders who disclose personal data without consent – with the intention to threaten, intimidate, harass or cause psychological harm to someone or his or her immediate family members.
The amendments would also empower the privacy commissioner to carry out criminal investigations, initiate prosecutions and demand the removal of doxxing content. Failure to comply with the authorities’ requests may lead to prosecutions.
But in a letter to the privacy commissioner, the Asia Internet Coalition expressed concern that the proposed changes would put locally-based staff of tech companies at risk of criminal charges.
“The proposal to subject such platforms to criminal liability is unnecessary and excessive, noting that these platforms are just making the service available to users for posting and should not be penalised for their users’ doxxing actions over which the platforms have no control,” it wrote.
It added that local staff of overseas platforms are not responsible for the operations of the platforms, and neither the local subsidiary nor the staff have access rights or control to administer the content.
“The only way to avoid these sanctions for technology companies would be to refrain from investing and offering their services in Hong Kong, thereby depriving Hong Kong businesses and consumers, whilst also creating new barriers to trade,” the coalition wrote.
“The possibility of prosecuting subsidiary employees will create uncertainties for businesses and affect Hong Kong’s development as an innovation and technology hub.”
The group also called for adequate exemptions to be put in place to balance the need to curb doxxing and the need to maintain a free flow of information.
It noted the government’s proposal seems to indicate that searching, aggregating, consolidating and republishing personal information, which is already available in the public domain, will constitute a doxxing offence without exemptions.