Data protection
The PDPO gives rights of access and correction and imposes six data protection principles. Amendments in 2021 created a specific doxxing offence and gave the Privacy Commissioner powers to demand the removal of doxxing content, including from overseas platforms.
Key points
| Access request | Answered within 40 days; a fee may be charged |
|---|---|
| Correction | Available where data is inaccurate |
| Direct marketing | Consent required; breach is a criminal offence |
| Doxxing | A specific offence since 2021, with cessation notices and extraterritorial reach |
| Breach notification | Voluntary rather than mandatory, unusually for the region |
| Regulator | Privacy Commissioner for Personal Data |
| Cross-border transfers | The transfer provision has still not been brought into force |
| Data access request | A statutory right; a reasonable fee may be charged |
| Doxxing powers | The Commissioner can issue cessation notices and prosecute |
| Compensation | Available through the courts for damage, including injury to feelings |
In practice
- Use the prescribed data access request form: non-compliance with it can justify refusal.
- For doxxing, ask the Commissioner for a cessation notice rather than going to court.
Cost and coverage
Access requests may carry a fee; complaints to the Commissioner are free.
Recent changes
The doxxing provisions have been used actively, including against overseas platforms, making Hong Kong one of the few places with a dedicated doxxing removal power.
Where to go
- Privacy Commissioner for Personal Data — complaints and doxxing hotline.
- Consumer Council for marketing-related complaints.
- Police Cyber Security and Technology Crime Bureau.
Worth knowing
If personal information is published to harass you, the doxxing route is faster than an ordinary privacy complaint: the Commissioner can issue a cessation notice directly to the platform. Unlike most regimes, a fee may be charged for a data access request. It must be directly related to the cost of compliance.
The general article: Data protection · Compare with another country
Privacy
The Personal Data (Privacy) Ordinance dates from 1996 and is enforced by the Privacy Commissioner for Personal Data. A 2021 amendment created two-tier doxxing offences and gave the Commissioner powers to demand removal of doxxing content and to investigate and prosecute directly — powers it uses.
Key points
| Statute | Personal Data (Privacy) Ordinance, in force since 1996 |
|---|---|
| Regulator | Privacy Commissioner for Personal Data, free complaints |
| Doxxing | Criminal offence since the 2021 amendment, with cessation notices |
| Data access request | Statutory right, with a modest fee permitted |
| Direct marketing | Strict opt-out regime with criminal penalties |
| Compensation | Civil claim for damage, including injury to feelings |
| No privacy tort | Reform proposals were made decades ago and never enacted |
| Statutory rights | The ordinance provides the operative protections |
| Cessation notices | Available for doxxing, with extraterritorial reach |
In practice
- For online exposure, the doxxing route through the Commissioner is faster than any court claim.
Where to go
- Legal Aid Department.
- Free legal advice scheme of the Duty Lawyer Service.
Worth knowing
The doxxing provisions apply extraterritorially and the Commissioner can serve cessation notices on overseas platforms: removal requests are worth making even where the content is hosted abroad. The absence of a general privacy tort means the ordinance is doing all the work. Its doxxing powers are the strongest element.
Image rights
The Crimes (Amendment) Ordinance 2021 introduced offences of voyeurism, unlawful recording or observation of intimate parts, publication of images originating from such acts, and publication or threatened publication of intimate images without consent. The separate doxxing amendment to the privacy ordinance gives the Privacy Commissioner power to demand removal.
Key points
| Statute | Crimes (Amendment) Ordinance 2021 |
|---|---|
| Offences | Voyeurism, unlawful recording, publication of intimate images, threats to publish |
| Doxxing | Separate criminal regime under the Personal Data (Privacy) Ordinance |
| Removal | Cessation notices from the Privacy Commissioner, including to overseas platforms |
| Court orders | Injunctions available |
| Anonymity | Reporting restrictions can be sought |
| Threats covered | Threatening to publish an intimate image is an offence in its own right |
| Cessation notices | The Commissioner can require removal, including from overseas services |
In practice
- Ask the Privacy Commissioner for a cessation notice: it reaches overseas platforms.
Where to go
- Hong Kong Police, Technology Crime Division.
- Association Concerning Sexual Violence Against Women.
Worth knowing
Before 2021 these acts had to be squeezed into unrelated offences and many prosecutions failed: the current framework is much more direct, but it applies only to conduct after it came into force. Both the publication and the threat to publish are offences. Evidence of the threat alone is enough to report.
The general article: Image rights · Compare with another country
Speech and online harassment
Defamation on the English model, a specific doxxing offence since 2021, and intimate image offences added the same year.
Defamation follows common law principles under the Defamation Ordinance. The 2021 amendments to the Personal Data (Privacy) Ordinance created a doxxing offence and gave the Privacy Commissioner power to issue cessation notices, including to overseas platforms. The Crimes (Amendment) Ordinance 2021 criminalised voyeurism and publication of intimate images.
Key points
| Defamation | Common law rules; libel actionable without proof of damage |
|---|---|
| Doxxing | Criminal offence with extraterritorial reach; cessation notices available |
| Intimate images | Publication and threats to publish criminalised in 2021 |
| Voyeurism | Separate offence created in 2021 |
| Harassment | No general statutory tort of harassment; remedies rely on other causes of action |
| Privacy Commissioner | Can require removal without court proceedings |
| Defamation Ordinance | Civil claims, with truth and fair comment as defences |
| Criminal intimidation | Applies to threats made online |
| Interim injunctions | Available but granted sparingly in defamation |
In practice
- For doxxing, ask the Privacy Commissioner for a cessation notice rather than suing.
Cost and coverage
Complaints to the Privacy Commissioner are free; civil defamation is expensive.
Recent changes
The doxxing cessation notice regime is one of the few administrative takedown mechanisms in Asia that reaches overseas platforms.
Where to go
- Privacy Commissioner for Personal Data — doxxing complaints.
- Police Cyber Security and Technology Crime Bureau.
- RainLily for image-based sexual abuse support.
Worth knowing
If personal details are published to harass you, frame the complaint as doxxing rather than defamation: the administrative route is far quicker and does not require you to sue. The doxxing regime has extraterritorial reach and the Commissioner can serve notices on overseas platforms.
The general article: Speech and online harassment · Compare with another country
Copyright
The 2022 amendment finally added parody, satire and quotation exceptions after more than a decade of debate.
The Copyright Ordinance protects works for the author's life plus fifty years. The Copyright (Amendment) Ordinance 2022, which came into operation in 2023, introduced a technology-neutral communication right, added exceptions for parody, satire, caricature and pastiche, quotation and commentary on current events, and provided safe harbours for online service providers.
Key points
| Statute | Copyright Ordinance, amended in 2022 |
|---|---|
| Term | Life plus 50 years |
| New exceptions | Parody, satire, caricature, pastiche, quotation, commentary on current events |
| Communication right | New technology-neutral right for the copyright owner |
| Safe harbour | For online service providers that act on notification |
| Media shifting | Limited exception for personal copies |
| Criminal liability | For distribution to an extent prejudicial to the owner |
In practice
- Use the statutory notification procedure to secure removal by a service provider.
Recent changes
The Copyright (Amendment) Ordinance 2022 came into operation in 2023, ending a reform process that had stalled since 2011.
Where to go
- Intellectual Property Department.
- Composers and Authors Society of Hong Kong.
- Customs and Excise IP investigation.
Worth knowing
The parody and quotation exceptions apply only to acts after the amendment came into operation in 2023: older conduct is judged under the previous, much narrower, framework.
The general article: Copyright · Compare with another country
Identity theft
Fraud and Theft Ordinance offences, with the Anti-Deception Coordination Centre reachable on 18222.
Identity fraud is prosecuted as fraud or obtaining property by deception under the Theft Ordinance, and as access to a computer with dishonest intent. The police Anti-Deception Coordination Centre operates the 18222 hotline and can work with banks to stop transfers. The Privacy Commissioner handles the underlying data breach.
Identity misuse in Hong Kong is prosecuted through the fraud, theft and forgery offences rather than a dedicated statute, and the operational centre is the police Anti-Deception Coordination Centre, reachable on 18222 around the clock. It can contact receiving banks quickly to try to stop a transfer, which is where the value lies — the criminal case usually matters less than the first phone call.
Key points
| Offences | Fraud and obtaining property by deception under the Theft Ordinance |
|---|---|
| Hotline | Anti-Deception Coordination Centre, 18222 |
| Data breach | Complaint to the Privacy Commissioner for Personal Data |
| Credit | TransUnion Hong Kong holds consumer credit data |
| Documents | Report a lost identity card to the Immigration Department |
| Banking | HKMA handles complaints about a bank's handling of a case |
| Scameter | A police tool for checking suspicious accounts and phone numbers |
| HKMA | Handles complaints about a bank's conduct |
| Immigration Department | Report a lost identity card immediately |
In practice
- Call 18222 immediately if a payment has been made.
- Report to the police and obtain a report number.
- Check your TransUnion credit report for unfamiliar accounts.
- Report a lost Hong Kong identity card to the Immigration Department.
- Check payees against the police Scameter before transferring money.
Where to go
- Anti-Deception Coordination Centre, 18222.
- Hong Kong Police, Technology Crime Division.
Worth knowing
The 18222 line exists precisely to stop money in transit. Calling it before doing anything else is what determines whether funds can be recovered.
Frequently asked questions
What does 18222 do?
It is the police Anti-Deception Coordination Centre hotline, staffed around the clock. It advises on whether something is a known scam and, crucially, can move to intercept a payment by contacting the receiving bank. Call before you call anyone else if money has left your account.
The general article: Identity theft · Compare with another country
General sources
- GovHK — official government portal