Exposing "Doxxing" Activities: A Breakdown of Criminal and Civil Liabilities—from Revenge Porn to Online Doxxing
Since the Legislative Council amended the Personal Data (Privacy) Ordinance in 2021, several individuals have been prosecuted for engaging in doxxing activities. Courts have frequently imposed imprisonment in these cases as a deterrent.
However, in addition to criminal liability, individuals involved in doxxing may also face civil liability. Victims have the right to seek compensation under relevant laws. Even if the perpetrator's identity is unknown, the victim can apply for an interim injunction to prevent further dissemination of their personal information.
In a recent case handled by our firm, the defendant used the plaintiff's name without consent to distribute the victim's images and personal data across various platforms. We successfully helped the plaintiff pursue civil action against the defendant, ultimately securing over HKD 400,000 in compensation.
Misuse of Personal Data
In tort law, misuse of personal data is a recognized cause of action. The plaintiff can claim damages for reputational harm and emotional distress caused by the defendant's unauthorized recording and online distribution of the plaintiff's personal data, such as private sexual images. Justice Godfrey Lam of the High Court highlighted in X & Y v Z [2020] HKCFI 826 that it was high time for Hong Kong courts to recognize the tort of misuse of private information.
In the UK, a case (FGX v Gaunt [2023] PIQR Q3) awarded the plaintiff approximately HKD 600,000 in damages after the defendant's distribution of private sexual images led to the plaintiff being diagnosed with PTSD.
Harassment and Punitive Damages
Harassment is also a tortious act. Courts may award damages for the fear, anxiety, distress, and humiliation suffered by the plaintiff due to harassment. If the defendant's malicious conduct exacerbated the plaintiff's harm, the court might grant punitive damages as a deterrent against future misconduct. In cases where the plaintiff suffers permanent harm, the court may consider awarding additional compensation.
Breach of the Personal Data (Privacy) Ordinance
Under Section 66 of the Personal Data (Privacy) Ordinance, the court may award damages for losses, including emotional harm, suffered by the plaintiff due to the defendant's breach of the ordinance. For example, in Tsang Po Mann v Tsang Ka Kit [2021] 1 HKLRD 1301, the court ordered the defendant to pay HKD 70,000 in damages for posting photos of the plaintiff walking their dog near their home.
Additionally, if doxxing posts involve defamatory statements that damage the victim's reputation, the defendant could also be liable for defamation. In assessing damages in defamation cases, the court considers various factors, including the severity of the defamation, the extent of its dissemination, and the emotional and reputational harm suffered by the plaintiff. For instance, in a deepfake case where the victim's image was combined with explicit content and widely circulated online, the severity of the case could lead to increased compensation. In a similar UK cyberbullying case (Johnson v Steele [2014] EWHC B24 (QB)), the court awarded approximately HKD 700,000 in damages due to the seriousness of the case.
On the other hand, mitigating factors may reduce the civil damages awarded, such as whether the defendant intentionally published the images, admitted to defamation, or apologized. If the defendant demonstrates these actions, the court may consider lowering the damages.
Conclusion
Anyone who engages in doxxing—publishing someone else's personal data without consent—may face both criminal and civil liability. Courts will typically consider various factors when determining whether to issue an injunction, order the deletion of private sexual images, require a public apology from the defendant, and award appropriate compensation to the victim.
