Hong KongPersonal Data (Privacy) Ordinance, sections 66J to 66P, cessation notices for doxxing messages
Personal Data (Privacy) Ordinance (Cap. 486), ss. 66J-66P
In force since .
A notice and action rule binding public and private bodies.
- Enforcement body
- Privacy Commissioner for Personal Data
As of .
What it requires
- If the Privacy Commissioner serves a cessation notice on you, take the cessation action it specifies on or before the date it specifies; the action can be removing the message from your platform, ceasing or restricting access to it or to the part or whole of the platform, or discontinuing the hosting service for that part or the whole (ss. 66L(2), 66M(3)).
- The notice reaches a person present, incorporated, established or registered in Hong Kong, or with a place of business there, and also a non-Hong Kong service provider that has provided or is providing any service to any Hong Kong person (s. 66M(1), (2), (5)).
- To contest a cessation notice, appeal to the Administrative Appeals Board within 14 days after it is served; the appeal does not suspend the notice, so comply while the appeal is pending (s. 66N).
- Complying with a cessation notice does not expose you to civil liability to another person only because of the compliance (s. 66P).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Contravening a cessation notice is an offence, liable on a first conviction to a fine at level 5 and imprisonment for 2 years and, for a continuing offence, a further fine of $1,000 for every day; on each subsequent conviction a fine at level 6 and imprisonment for 2 years and a further fine of $2,000 for every day (s. 66O(1)).
What this law does
Under section 66M(1) of the Personal Data (Privacy) Ordinance, the Privacy Commissioner for Personal Data may serve a written notice on a Hong Kong person who is able to take a cessation action, directing the person to take it, where the Commissioner has reasonable ground to believe that there is a subject message.
The Commissioner may also serve a cessation notice on a non-Hong Kong service provider that is able to take a cessation action in relation to a subject message that is an electronic message.
A subject disclosure is a disclosure of a data subject's personal data, without the data subject's relevant consent, with an intent to cause specified harm or being reckless as to whether specified harm would be caused, where the data subject is a Hong Kong resident or is present in Hong Kong when the disclosure is made.
A cessation action includes removing the message from the electronic platform on which it is published, ceasing or restricting access to it, and discontinuing the hosting service for the part of the platform on which it is published or for the whole platform. The cessation notice must state the Commissioner's belief and its ground, identify the message, specify the cessation action and specify the date on or before which it must be taken.
An appeal against a cessation notice may be made to the Administrative Appeals Board within 14 days after service, and the appeal does not affect the operation of the notice. A person who contravenes a cessation notice commits an offence, liable on a first conviction to a fine at level 5 and imprisonment for 2 years, with a further daily fine for a continuing offence, and on each subsequent conviction to a fine at level 6 and imprisonment for 2 years, with a higher daily fine.
It is a defence to show a reasonable excuse, including that compliance could not reasonably be expected having regard to the nature, difficulty or complexity of the cessation action, that the technology necessary for complying was not reasonably available or that there was a risk of incurring substantial loss to, or substantially prejudicing the right of, a third party. A person who complies with a cessation notice does not incur civil liability to another person only because of that compliance. The Personal Data (Privacy) (Amendment) Ordinance 2021 came into effect on .
When LexLint raises it
When your app profile says your app operates a social platform or reuses other publishers' content.