The legal framework
The Personal Data (Privacy) Ordinance dates from 1996 and is enforced by the Privacy Commissioner for Personal Data. A 2021 amendment created two-tier doxxing offences and gave the Commissioner powers to demand removal of doxxing content and to investigate and prosecute directly — powers it uses.
Key points
| Statute | Personal Data (Privacy) Ordinance, in force since 1996 |
|---|---|
| Regulator | Privacy Commissioner for Personal Data, free complaints |
| Doxxing | Criminal offence since the 2021 amendment, with cessation notices |
| Data access request | Statutory right, with a modest fee permitted |
| Direct marketing | Strict opt-out regime with criminal penalties |
| Compensation | Civil claim for damage, including injury to feelings |
| No privacy tort | Reform proposals were made decades ago and never enacted |
| Statutory rights | The ordinance provides the operative protections |
| Cessation notices | Available for doxxing, with extraterritorial reach |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- For online exposure, the doxxing route through the Commissioner is faster than any court claim.
Where to go
- Office of the Privacy Commissioner for Personal Data.
- Legal Aid Department.
- Free legal advice scheme of the Duty Lawyer Service.
Worth knowing
The doxxing provisions apply extraterritorially and the Commissioner can serve cessation notices on overseas platforms: removal requests are worth making even where the content is hosted abroad. The absence of a general privacy tort means the ordinance is doing all the work. Its doxxing powers are the strongest element.
Official sources and links
- GovHK — official government portal