Current Laws and Regulations

"Criminal law and procedure is concerned with the nature, prosecution and punishment of crime". The basic elements of a crime are "actus reus" namely "the conduct which is prohibited and defined" by law, and "mens rea" namely "an intention to commit a crime". Currently, there is no law on cyberbullying. A person who does an act of cyberbullying may contravene the following laws:

 

 

In a civil action, the court determines disputes between individuals or organizations. 

 

1. Tort of Harassment

 

In Lau Tat Wai v Yip Lai Kuen Joey [2013] 2 HKLRD 1197, the judge took the term "harassment" to mean "a course of conduct by a person, whether by words or action, directly or through third parties, sufficiently repetitive in nature as would cause, and which he ought reasonably to know would cause worry, emotional distress or annoyance to another person". 

 

An example of harassment in the online world can be seen in the UK case of Kim Suttle v Samantha Walker [2019] EWHC 396 (QB). The Defendant uploaded videos on Facebook and Youtube alleging that the Claimant was 'abusing or kicking' her dog, arousing hatred against the Claimant. The Claimant suffered from online abuse and subsequently filed a claim for libel and harassment (ChronicleLive, 2019). 

 

The judge in Kim Suttle v Samantha Walker found that "the campaign was clearly deliberate and targeted, personal, vicious, frightening, calculated to whip up hatred and put the Claimant in fear of safety. It was relentless for three to four weeks. The Facebook group was used to recruit others to gang up on the Claimant. Hiding behind online anonymity is a hallmark of cyberbullying; a victim feels constantly under siege and doesn't know what to do to stop it..." (Inforrm, 2019). Ultimately, damages were awarded to the Claimant. 

 

2. Tort of Trespass to the Person

 

There are 3 forms of trespass to the person namely assault, battery and false imprisonment (see Tort Law & Practice in Hong Kong, Third Edition, 2014 [6.002, 6.008-6.010]). Collins v Wilcock [1984] 3 All ER 374 explains the three forms as follows:

 

     (i) Assault refers to “an act which causes another person to apprehend the infliction of immediate, unlawful force on his person”;

     (ii) Battery refers to “the actual infliction of unlawful force on another person”; and

     (iii) False imprisonment refers to “the unlawful imposition of constraint upon another’s freedom of movement from a particular place”.

 

To constitute “trespass to the person”, the defendant’s act must be intentional (see Tort Law & Practice in Hong Kong, Third Edition, 2014 [6.003]). In the case of cyberbullying, the tort of assault may occur.

 

3. Tort of Defamation

 

If a person makes a publication that would "tend to lower the (victim) in the estimation of right-thinking members of society generally" (see Sim v Stretch [1936] 2 All ER 1237, Bullen and Leake and Jacobs Precedents of Pleadings Hong Kong Third Edition, 2021 [18-02]), such act may constitute defamation. Defamation takes two forms, namely slander and libel.

 

Slander refers to defamatory matters in a temporary form, mainly spoken words, or even physical gestures. Libel refers to publishing defamatory matters in a permanent form, such as in writing or in printed form (see Tort Law & Practice in Hong Kong, Third Edition, 2014 [21.004]).

 

4. Tort of Intimidation

 

The elements of this tort include “unlawful threat, intention to cause harm to the claimant with the threat, and damage to the claimant” (Lau Tat Wai v Yip Lai Kuen Joey [2013] 2 HKLRD 1197 para 43).

 

Depending on the circumstances of each case, if the claimant wins the case in civil proceedings, the claimant could be granted the following type of reliefs by the court: damages, specific performance, injunction, declaration or other type of orders (see Department of Justice’s website https://www.doj.gov.hk/en/legal_dispute/litigation.html for further information).

Privacy Commissioner for Personal Data in Hong Kong has laid down certain data protection principles (the “DPP”s) under the Personal Data (Privacy) Ordinance, which address the privacy and legal issues related to a person's private data. Internet users are to uphold these principles and to respect the privacy of others in the cyber world as well. In particular, the following three DPPs are relevant to cyberbullying:

 

1. DPP1 Purpose and Manner of Collection: Personal data should not be collected unless the collection is for a lawful purpose. The data collected should be necessary but not excessive. The means of collection must be lawful and fair.

 

2. DPP3 Use of Data: Personal data collected must not be used for a new purpose which is not or is unrelated to the original purpose when collecting the data, unless express and voluntary consent is obtained from the data subject.

 

3. DPP4 Data Security: Data users should take all practicable steps to protect the personal data in their possession and avoid unauthorized or accidental use of the data.

 

For more details about PCPD, please visit: https://www.pcpd.org.hk/

Doxxing is "a form of cyberbullying that uses sensitive or secret information, statements, or records for the harassment, exposure, financial harm, or other exploitation of targeted individuals" (Fortinet, 2021). 

 

In order to further protect the privacy of an individual, the PDPO was amended. Doxxing offences have been created to penalize those who disclose personal data without the data subject’s consent. “Data subject” refers to “the individual who is the subject of the data” (see section 2 of the PDPO).

 

The amendments came into effect on 8 October 2021, and should be able to tackle this form of cyberbullying. A brief summary of the amendments is as follows:

 

1. The act of doxxing is criminalized with two-tier offences:

First tier offence

Sections 64(3A) and (3B) of the PDPO provide that:

 

“(3A) A person commits an offence if the person discloses any personal data of a data subject without the relevant consent of the data subject—

 

(a) with an intent to cause any specified harm to the data subject or any family member of the data subject; or

(b) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject. 

 

(3B) A person who commits an offence under subsection (3A) is liable on conviction to a fine at level 6 (i.e. $100,000) and to imprisonment for 2 years.”

 

Second tier offence

Sections 64(3C) and (3D) of the PDPO provide that:

 

“(3C) A person commits an offence if—

(a) the person discloses any personal data of a data subject without the relevant consent of the data subject—

       (i) with an intent to cause any specified harm to the data subject or any family member of the data subject; or

       (ii) being reckless as to whether any specified harm would be, or would likely be, caused to the data subject or any family member of the data subject; and

(b) the disclosure causes any specified harm to the data subject or any family member of the data subject. 

 

(3D) A person who commits an offence under subsection (3C) is liable on conviction on indictment to a fine of $1,000,000 and to imprisonment for 5 years.”

 

The two offences are differentiated because the second tier offence requires that the doxxing act has actually caused specified harm to the data subject or his/ her family members. Hence, the second tier offence attracts a maximum term of 5 years of imprisonment as opposed to the first tier offence which attracts a maximum term of 2 years of imprisonment.  

 

2. The Privacy Commissioner for Personal Data (“the Commissioner”) is granted with investigative and prosecution powers

Under sections 66D(1) and (2) of the PDP0:

 

"(1) ... if the Commissioner reasonably suspects that, in relation to a specified investigation, a person—

       (a) has or may have possession or control of any material relevant to that investigation; or

       (b) may otherwise be able to assist the Commissioner in relation to that investigation.

 

(2) The Commissioner may, by written notice given to the person, require the person—

       (a) to provide the Commissioner with any material in the person’s possession or control relating to a matter that the Commissioner reasonably believes to be relevant to the specified investigation;

       (b) to attend before the Commissioner at a specified time and place, and answer any question relating to a matter that the Commissioner reasonably believes to be relevant to the specified investigation;

        (c) to answer any written question relating to a matter that the Commissioner reasonably believes to be relevant to the specified investigation;

       (d) to make a statement relating to a matter that the Commissioner reasonably believes to be relevant to the specified investigation; or

     (e) to give the Commissioner all the assistance that the Commissioner reasonably requires for the specified investigation.”

 

Furthermore, under section 64C of the PDPO:

 

"(1) The Commissioner may prosecute in the name of the Commissioner (for certain offences under the Ordinance).

 

(2) Any offence prosecuted under subsection (1) must be tried before a magistrate as an offence that is triable summarily.

 

(3) This section does not derogate from the powers of the Secretary for Justice in respect of the prosecution of criminal offences.”

 

3. The Commissioner is granted with the power to serve cessation notices

Under section 66M of the PDPO:

 

"(1) If the Commissioner has reasonable ground to believe that—

       (a) there is a subject message; and

       (b) a Hong Kong person is able to take a cessation action (whether or not in Hong Kong) in relation to the message,

   

the Commissioner may serve a written notice on the person directing the person to take the cessation action.

 

(2) ... if the Commissioner has reasonable ground to believe that—

     (a) there is a subject message that is an electronic message; and

    (b) a non-Hong Kong service provider is able to take a cessation action (whether or not in Hong Kong) in relation to the message,

 

the Commissioner may serve a written notice on the provider directing the provider to take the cessation action.”

 

A cessation action requires the individual or an entity such as an operator of an overseas social media platform, upon whom a cessation notice is served by the Commissioner under section 66M of the PDPO, to remove doxxing content in the message (in our case in electronic form), so as to avoid or minimize the harm that may be caused to the data subject and his/ her family member. 

 

Under section 66L of the PDPO, a cessation action includes an action to "remove the message from the electronic platform on which the message is published", "cease or restrict access by any person..." and "discontinue the hosting service for the part... or the whole of the relevant platform".