 |
| Hong Kong's new anti-doxxing law has sparked concerns for Facebook, Twitter and other HK based tech giants. |
Hong Kong is one of the biggest financial centers in the world, ranking just behind New York, London and Shanghai. It is governed as a semi-autonomous special administrative region of the Communist China. Despite not being a full-fledged democracy, Hong Kong is crowned as one of the freest economies in the world, but that won't be for long. If you look at recent legal developments in the city, it is feared Hong Kong's much touted 'one country, two systems' framework will sooner or later give into China's heavy hand and it may even thereby lose its relevance as a global financial hub.
Since late 2020, when Beijing imposed a draconian national security law to crackdown on pro-democracy dissenters, China has been able tighten its grips on Hong Kong, progressively eroding the city's long-standing democratic culture. This is a worrying move for a city like Hong Kong which was once praised as a beacon of freewheeling prosperity. Its English-derived common law legal system has also been under pressure in recent times with Chinese-backed authoritarian legalism taking root in the city.
Background to enacting the new anti-doxxing law.
In its latest authoritarian move, Hong Kong's legislative council signed into law controversial anti-doxxing law, 'Personal Data (Privacy) (Amendment) Ordinance 2021' as a measure to toughen its privacy laws and counter doxxing. The amendment bill was passed with the full support of the pro-Beijing camp. There was no official opposition to the bill since pro-democracy lawmakers resigned en masse in late 2020 in response to the Chinese government's resolution to dismiss some of their pro-democracy politicians for national security reasons. Interestingly, Hong Kong's new privacy law came into being amidst Chinese top legislature enacted 'Personal Information Protection Law' which is said to be one of the toughest privacy laws in the world. According to China's new privacy legislation internet services and apps could face suspension or even termination if they found guilty of illegally processing personal data, without prior consent of data subjects.
Human rights groups and tech giants among the critics of the new privacy law.
What Hong Kong's new anti-doxing law is about?
The Personal Data (Privacy) Ordinance (PDPO) governs the law relating to privacy of personal data in Hong Kong and has been in effect since 1996. Section 64(3A) introduced by Personal Data (Privacy) (Amendment) Ordinance 2021, criminalizes the act of doxxing. Doxxing involves the act of harassing of individuals and organizations (which the Act refers to as data subjects) by malicious publishing of their personal information to the public without consent, often on the internet platforms. The new law says, unauthorized disclosure of personal data with mere recklessness or intent to cause a specified harm to a data subject or any of his family members is a crime. According to section 64(5), the term 'specified harm' includes harassment, molestation, pestering, threat or intimidation, bodily harm, psychological harm, harm to personal safety, wellbeing and damage to the property of a data subject.
In terms of section 64 (3D), where the intended specified harm is actually inflicted on a data subject or a family member, an offender could face up to 5 years of imprisonment and fines amounting to HK $1 million. If the intended harm is not inflicted, an offender would face only an imprisonment for 2 years and a level 6 fine(HK $100,000).
Sweeping powers given to Privacy Commissioner.
Under the new law, the office of the Privacy Commissioner for Personal Data, the city's dedicated data privacy watchdog, is empowered to investigate cases of doxxing and to press charges on offenders without referring cases to police or waiting for department of justice to initiate prosecution. He has also been given authority to demand doxxing contents to be rectified or to be removed, both on local and overseas internet platforms.
Moreover, sweeping powers have been given to the privacy commissioner to gain access to electronic devices of service providers without a warrant under 'urgent circumstances'. However, the commissioner would still require to use only 'reasonable force', and a warrant is required to search premises. The new law also makes it a crime to not to cooperate to investigations into doxxing claims conducted by the commissioner. Thereby suspects accused of doxxing have been effectively deprived of right to remain silent during the investigation process. If they do not cooperate and opt to remain silent, they would risk prosecution for a separate offence in addition to the doxxing charge.
Why doxxing is a matter of serious concern for Hong Kong?
Since the outbreak of massive pro-democracy protests in 2019, protecting personal data has been a greater challenge in Hong Kong. Politicians from both sides and protesters have been practicing less and less self-discipline that they resorted to doxxing personal data as a political weapon to attack those who took a contrary political stance to their political beliefs. It led to mutual destruction and erosion of privacy rights of individuals. Private information of police officers and judges was exposed during pro-democracy unrest. There have been reports where public officials, police officers and lawmakers have experienced inconvenience and faced threats to their personal safety, when unknown individuals started misusing their personal information without their knowledge to order takeaways, to register for COVID tests and organ donations.
In most cases doxxing contents originated from overseas servers outside of Hong Kong, which PDPO could not do anything about since it lacked extraterritorial jurisdiction. Under the new law, this problem has been resolved. In this backdrop, supporters of the new bill say the previous privacy legislation is some what a stone age, toothless legislation not quipped to tackle the large-scale information disclosures in this fast internet age, and it was necessary to bring in a more stringent privacy legislation to restore order in the country. Privacy commissioner barrister-at-law Ada Chung also defended the new law, emphasizing that cyber space is not beyond the law, and as doxxing is a serious matter of concern it warrants tough laws.
Ada Chung was right. Modern day cyber space has no territorial limits in terms of transborder flows of data. Therefore technology-neutral data protection laws currently in operation must be upgraded to deal with this evolving privacy landscape. This aspect has been taken into consideration in amending Hong Kong's privacy laws. So, under the new law, wherever the doxxing content comes from, if it threatens privacy of a Hong Kong resident, the commissioner has power to take down those contents from the internet and block access to those contents for Hong Kong users. This extra-territorial element is a remarkable feature of the new law.
Earlier this week, a 45-month prison sentence, the toughest doxxing sentencing so far was handed down by a judge under the previous law, to a former clerk in Immigration Department who pleaded guilty to unauthorized disclosure of personal data of 215 public officials that were to be shared on social platform Telegram. Now Hong Kong is also mulling over setting up a notification mechanism to inform victims of doxxing of their leaked information, which is a progressive move.
From being toothless to unchecked powers, where is the new law heading?
The prime focus of introducing a privacy law is to empower the citizens by protecting their privacy. But when that focus is shifted to some other secondary purpose such as preventing doxxing, the legislative framework will lose sight of its legitimate purpose and will go into a state of disarray, ultimately losing the true purpose behind enacting a privacy legislation in the first place, and inevitably coming into conflict with guaranteed individual freedoms such as free speech beyond permissible limits.
One should strongly take into consideration principles of necessity and proportionality in deciding the scope of any legislative measure. That is a first principle one need to adhere to in the law making process. If you take a glance at the new amendment law, you would see it is all about doxxing, no consideration is given to all other aspects a robust data protection regime would require in the modern day cyber space. It includes disproportionately wide and unacceptably vague provisions which would unduly curtail free speech and restrict the free flow of data on tech platforms.
Despite government's assertions that the motive behind enacting the new law is not to target internet platforms, tech firms fear, the law would effectively require suspension of the internet services offered on their platforms. Many speculate that far-too-broad provisions of the new law are open to be abused and would open floodgates for insignificant complaints of harmless mentioning of a person's name on a social media post. Local staff employed on these platform services are at the risk of being unjustifiably prosecuted for doxxing content individual users create, and they do not have editorial control over those contents.
An indiscriminate all-out crackdown on doxxing as envisioned by the new law is just as harmful and irresponsible as doxxing itself. Many speculate Hong Kong's new anti-doxxing law would severely restrict public access to information and negatively affect freedom of expression, journalism and whistleblowing. No doubt, it will be a just another political tool for the government to exert pressure on pro-democracy camp forcing the citizenry to come to a point of self-censorship. Many believe the new law to one of the toughest privacy laws in the world. But in being the toughest, the costs are certainly high. Before crowning any privacy law as the toughest, one should bear in mind the simple truth; the toughest privacy laws do not always protect a citizen's privacy and being 'toughest' does not always guarantee it is the best and most progressive data protection law. Hong Kong's new privacy law is no different from that; protection of citizens' privacy is not at the heart of the legislation. There are certainly ulterior political motives involved.
No comments:
Post a Comment