District judge says the ‘deterrent sentence’ for Chan King-hei was needed given the seriousness of the crime committed during Hong Kong’s anti-government protest movement last year.
Chan King-hei was found guilty last month of using the computer system of his then-employer to access the personal data of three public figures, 20 police officers and six of their family members from July to August last year.
Chan King-hei, the first person found guilty of doxxing during Hong Kong’s anti-government protest movement, has been jailed for two years.
District Judge Frankie Yiu Fun-che on Tuesday said the case before him warranted a deterrent sentence as it involved a breach of trust and the sharing of the personal data of an inspector’s father at a time when police-community relations were already tense due to social events.
He added that doxxing could have a serious psychological impact on law enforcement officers and cause great distress for innocent family members, as seen in the father’s victim impact assessment, in which he complained of feeling helpless, fragile and anxious about his safety.
“Without question, the court must impose a deterrent sentence to prevent others from following suit,” the judge said.
The case was the first of its kind since the relevant offence was introduced following an amendment of the Personal Data (Privacy) Ordinance in 2012.
The privacy commissioner for personal data, Ada Chung Lai-ling, welcomed the ruling after the sentence was announced, reminding the public that the online world was not beyond the law.
“It is saddening that doxxing acts often lead to cyberbullying or even criminal intimidation of the victims and their family members, which in turn causes continuous distress and serious psychological harm to the persons concerned,” Chung said. “Other than being morally wrong, doxxing acts may constitute criminal offences.”
Chan, 33, was found guilty last month of using the computer system of his then-employer Hong Kong Telecommunications to access the personal data of three public figures, 20 police officers and six of their family members, without company permission, from July to August last year.
The telecoms worker was also found to have saved the personal data of 29 individuals, recorded 63 addresses – including 28 police quarters – and shared the details of the inspector’s father on September 9, 2019.
The District Court heard Chan had admitted to impulsively sending a tip containing the father’s name, identity card and telephone numbers to a Telegram-based channel, “Dadfindboy”, where details of other officers and their family members could also be found, because he wanted to correct inaccurate personal data found online.
In mitigation, Chan said he had acted on impulse, fuelled by anger and anxiety brought about by the anti-government protests,but that he now understood his methods were inappropriate.
Chan said he regretted his actions and promised not to repeat the offences.
But the judge found it hard to accept that Chan’s actions had been impulsive, observing that the search for the private information was neither direct nor simple, and required step-by-step verification.
Chan was sentenced on three counts of obtaining access to a computer with a view to dishonest gain for himself or another, and one count of disclosing personal data obtained without consent.
Both offences are punishable by five years in prison.
The telecoms worker was the first person found guilty of doxxing since June 2019, when a since-withdrawn extradition bill sparked citywide protests.
As of the end of last month, the Office of the Privacy Commissioner for Personal Data had written more than 200 requests to the operators of 18 websites and online social media platforms for the removal of more than 3,500 doxxing web links.
Some 1,400 cases have since been referred to police for follow-up.
A police spokesman said more than 3,800 officers and their family members had been doxxed, cyberbullied and harassed since the protests.
Subsequent investigations led to the arrest of 54 men and 14 women, aged between 16 and 60, on a range of charges that included disclosing personal data obtained without consent, criminal damage, fraud and incitement to commit public nuisance.
Police also applied for anonymity orders to conceal the identity of some officers involved in protest-related prosecutions, and secured a High Court injunction in October 2019 banning doxxing activities concerning officers and their families.
In June, a designer became the first person held civilly liable for breaching the injunction, after she admitted to posting the personal information of a police officer and his family on her Facebook page on November 5, 2019. She was given a suspended sentence for civil contempt of court.