On November 20, 2023, the Office of the Privacy Commissioner for Personal Data (PCPD) attended the meeting of the Legislative Council Panel on Constitutional Affairs, where it reflected on the effectiveness of the amendments of the Personal Data (Privacy) Ordinance (PDPO) in its anti-doxxing efforts since it came into effect in October 2023. Furthermore, in the paper presented at the meeting, the PCPD also revealed that there are considerations to further amend the PDPO in order to strengthen personal data protection and address challenges posed by internet technology developments. 

How effective were the PCPD's anti-doxxing efforts? 

The PCPD mentioned that it had initiated 228 criminal investigations and made 39 arrests. The PCPD referred 55 cases to the police in respect of the more serious cases and cases involving other criminal offenses. The PCPD also issued over 1,800 cessation notices to 49 online platforms, requesting the removal of nearly 27,000 doxxing messages. Further, over 180 doxxing channels were successfully removed. Overall, the PCPD confirmed that the enforcement efforts were very effective, as the compliance rate on the removal of doxxing messages was over 95%. 

What are the considerations for future PDPO amendments? 

The PCPD stated that there were considerations for additional amendments to the PDPO to address evolving challenges in personal data privacy protection. Some of the proposed changes include: 

• establishing a mandatory data breach notification mechanism;  
• requiring data users to devise a data retention period policy;  
• empowering the PCDP to hand down administrative fines;  
• directly regulating data processors; and  
• clarifying the definition of personal data. 

You can read the press release here and the panel paper here.