HKSAR v. IP, ANTHONY CHUN HIN

HCMA 198/2023 and HCMA 51/2024

(Heard Together)

[2025] HKCFI 5043

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

APPELLATE JURISDICTION

MAGISTRACY APPEAL NO 198 OF 2023

(ON APPEAL FROM WKCC 1638 OF 2022)

________________

BETWEEN

________________

AND

IN THE HIGH COURT OF THE

HONG KONG SPECIAL ADMINISTRATIVE REGION

COURT OF FIRST INSTANCE

APPELLATE JURISDICTION

CASE STATED

MAGISTRACY APPEAL NO 51 OF 2024

(ON APPEAL FROM WKCC 1638 OF 2022)

________________

BETWEEN

________________

_______________

J U D G M E N T

_______________

1.  The Appellant in HCMA198/2023, who is the Respondent in HCMA 51/2024 (“Appellant”), is charged with two counts of “disclosing personal data without data subject’s consent” (namely “Charge 1” and “Charge 2” respectively), contrary to section 64(3C) and 3D of the Personal Data (Privacy) Ordinance, Cap.486 (“PDPO”).

2.  After trial, the Magistrate acquitted the Appellant of Charge 1 but convicted the Appellant of the lesser offence of section 64(3A) of the PDPO and also the Charge 2.

3.  The Appellant now appeals against conviction of both charges whilst the Respondent in HCMA 198/2023, who is the Appellant in HCMA 51/2024 (namely “Prosecution” or “Respondent”), appeals against the acquittal of the Appellant of Charge 1.

Prosecution’s Case

4.  As briefly summarised by the Respondent, the Appellant and Mr X (“PW1”, the data subject of Charge 1) were friends and they had known each other for a few years at the material time. Miss Y (“PW2”, the data subject of Charge 2) was PW1’s girlfriend. In 2021, PW2 became the registered owner of a flat, which PW1 and PW2 intended to be their matrimonial home (“Flat”) and the Appellant was engaged to complete some renovation work. As PW1 and PW2 were of the view that the Appellant failed to complete the renovation work, they refused to pay him the remaining sums. PW1 even wrote an email to the Appellant on 18 October 2021 (P2; “Email”).

5.  On 19 October 2021, the Appellant used his Facebook account “Devi Ruki” (“Account”) to publish a post in a private group named “裝修佬聯盟”, which disclosed various personal data of PW1 and PW2 (i.e. those included in the particulars of Charges), the content of the Email and a video showing the interior of the Flat (P3A; “Post 1”). On the next day, the Appellant used the Account to publish another post in a public group named “裝修 設計 清拆 還原 好師傅 報價 分享平台”, the content of which was largely identical to Post 1 but without the content of the Email (P5A; “Post 2”).

6.  According to PW1, on the day after the publishing of Posts 1 and 2, a male claimed to be acting on behalf of the Appellant called PW1’s company to chase for money. There was another occasion when he picked up a silent call, and he had asked the security guard in his building to enhance security. He had also changed the lock on the entrance door of the Flat.

7.  PW4, who was PW1’s colleague, confirmed that she picked up a phone call in mid-October and the caller claimed to be PW1’s wife, and she received another phone call from a male on or around 26 October 2021 looking for PW1 and claiming that he owed some money. PW4 also received several silent calls. The matter was reported to PW1’s superior (“PW3”), who then issued a letter to PW1 (P14) informing him of the company’s decision to postpone his promotion.

8.  As for PW2, who was a kindergarten teacher, her colleague received a phone call on 25 October 2021, the caller made false allegations against PW2 and demanded the school to dismiss her, otherwise the caller threatened to put up posters around PW2’s workplace. As a result of the phone call, PW2’s supervisor asked to see her and enquired about the matter. The abovementioned false allegation raised great concern to her safety and well-being. It also affected how her subordinates, employer and parents viewed her.

Appellant’s case

9.  The Appellant elected not to testify nor calling any defence witness.

Magistrate’s findings

10.  Given the Appellant did not heavily dispute the factual aspect of the prosecution witnesses’ testimonies and that their testimonies were simple, clear, straightforward and unshaken under cross-examination, the Magistrate accepted their evidence as true.

11.  As for the Appellant’s explanation given in the video recorded interviews (i.e. he published the two posts to show others his craftsmanship and to warn others not to take up PW1 and PW 2’s renovation work), the Magistrate noted that it was inconsistent with the content of the two posts. In addition, the video recorded interviews were unsworn evidence and not scrutinised under cross-examination and thus the Magistrate refused to accept the exculpatory part of his evidence.

12.  As to the elements of offence, the Magistrate ruled that:

1) The Appellant had disclosed the personal data of PW1 and PW2 in Post 1 and Post 2.

2) Having taken into account the background of the case, the nature of the personal data disclosed, the extent of the details disclosed, the words used in each post, the overall content of each post, the time interval between the two posts, the platform (i.e. Facebook) used for the disclosure and the Appellant’s replies to the comments of other online users, the Magistrate was of the view that the only irresistible inference was that the Appellant intended to cause to PW1 and PW2 the specified harm stipulated in section 64(6)(a) (harassment, molestation, pestering, threat or intimidation) (“Harassment Harm”) and section 64(6)(c) (harm causing the person reasonably to be concerned for the person’s safety or well-being) ( “Safety/Well-being Harm”).

3) On what constitutes the Harassment Harm, the Magistrate agreed that harassment embraces acts of repeated or continuous nature and that a continuing state is implicit in terms such as “molestation” and “pestering” but the Magistrate did not rule out the possibility that a single incident could be described as harassment depending on the circumstances of the case.

4) As to what constitutes the Safety/Well-being Harm, the Magistrate was of the view that there must be some harm caused by the disclosure in the first place and that harm causes a data subject to be reasonably concerned.

13.  Regarding the Charge 1, the Magistrate ruled that the telephone calls received by PW1 fell short of what was required so as to cause the Harassment Harm. In addition, whilst the Magistrate agreed that PW1 must be reasonably concerned over his safety or well-being upon learning that his personal data was disclosed by the Appellant, the Magistrate was not satisfied that the disclosure caused any harm to PW1 which in turn caused him to be reasonably concerned. As a result, the Magistrate acquitted the Appellant of Charge 1 and convicted him of the offence under section 64(3A) of the PDPO.

14.  Regarding the Charger 2, given the seriousness of the allegation and the circumstances surrounding the telephone conversation, the Magistrate was of the view that it constituted a threat or intimidation under section 64(6)(a) of the PDPO. In addition, the Magistrate ruled that the phone call to PW2’s workplace could be described as a kind of harm within section 64(6)(c) of the PDPO. Having considered PW2’s evidence, the Magistrate also found that PW2 became concerned for her safety and well-being because of the harm and given the circumstances of the case. The Magistrate was also satisfied that the harm did amount to something which caused PW2 to be reasonably concerned for her safety and well-being. Thus, the Magistrate convicted the Appellant of Charge 2.

Appellant’s grounds of appeal against conviction

15.  The Appellant put forward the following grounds of appeal. First, the Magistrate erred in law to allow the Prosecution to amend charges after plea had been taken. Second, there was no evidence, or no sufficient evidence whereon to found the said convictions.

16.  However, the Appellant did not file any written submissions to substantiate his grounds of appeal.

Respondent’s reply

17.  On ground 1, the Respondent submits that it was held by the Court of Final Appeal in HKSAR v Tse So So[1] that magistrates possess “a general power to amend a defective information so as to ensure that the charges to be faced by the defendant at the trial are accurately stated”, and that such power is necessary as it “enables the magistrates effectively to exercise their summary jurisdiction and to safeguard the defendant from prejudice”. Thus, it is submitted that it is within the Magistrate’s power to allow the Prosecution’s application for amending the charges.

18.  Further, in above case, it was also stated:

“But it commonly occurs that prior to the trial, the prosecution realises that it needs to be amended either because it is defective in form or substance or because the evidence to be called, while disclosing a relevant criminal offence, will not make out the offence as particularised in the information. The present case is such an instance. One would expect that in such circumstances, an application should be made to amend in advance of the trial, giving notice in good time of what the prosecution’s case will actually be and enabling the parties to prepare for the real issues and to avoid misdirected efforts and wasted costs.”

The Respondent therefore submits that no prejudice had been caused to the Appellant. The amendments were made before trial commenced and no evidence had yet been adduced when the application for amendments was made and granted. The Appellant was legally represented by a senior counsel and the Prosecution’s application was being argued before the court. The Appellant has not raised any argument that he was in any way prejudiced by such amendments.

19.  On Ground 2, the Respondent stresses that the Magistrate rightly pointed out that the Appellant in fact did not dispute the factual aspect of the Prosecution witnesses’ testimonies and it was agreed that,

i) the Appellant owned and used the Account;

ii) the Account published Posts 1 and 2; and

iii) both Posts contain the personal data of PW1 and PW2 and thus there should be no dispute that the Appellant had disclosed the personal data of PW1 and PW2.

20.  What remains in dispute would be:

i) whether the Appellant intended to cause to PW1 and PW2 the specified harm stipulated in section 64(6)(a) and (c) of the PDPO; and

ii) whether the Appellant’s disclosure did cause specified harm to both PWs.

21.  On the intention issue, the Respondent submits that the Magistrate had every basis to reject the Appellant’s suggestion that Posts 1 and 2 were just about showing the Appellant’s craftsmanship and to conclude that the Appellant had the necessary intention. Such factors include:

(1) extensive details of PW1 and PW2’s personal data being disclosed: if the Appellant only intended to show how well his craftsmanship was or to warn others in the same trade not to take up PW1 and PW2’s work, there was simply no need for the Appellant to disclose so much information about the two witnesses;

(2) the Appellant updated the contents of both Posts 1 and 2 after publishing them. The updated content had nothing to do with the parties’ contractual dispute;

(3) the Appellant had made not just one but multiple comments under each post. Such comments include attempts to get support and plea for actions from others; and

(4) it is not difficult for Facebook users to join Group 1 and that Group 2 is in fact a public group.

22.  The Respondent submits that the Magistrate did not err in ruling that the Appellant intended to cause to PW1 and PW2 the specified harm stipulated in section 64(6)(a) and (c) of the PDPO, and thus the Magistrate was right, in relation to PW1’s case, in convicting the Appellant of the lesser offence of section 64(3A) of the PDPO.

23.  As for PW2, the Magistrate’s finding was that the caller who made the call to PW2’s workplace demanded for the dismissal of PW2 and if refused, the caller threatened to spread the accusation against PW2 by sticking posters or newspapers at the area around her workplace.

24.  Based on the circumstances and nature of the call, the Magistrate was right in concluding that the phone call could be described as a kind of harm within section 64(6)(c) of the PDPO and PW2 became concerned for her safety and well-being because of the said harm and thus specified harm was caused to PW2 as a result of the Appellant’s disclosure.

25.  Further, although there was no direct evidence showing that the said phone call was caused by the Appellant’s disclosure, the Magistrate had rightly pointed out that there was sufficient evidence to draw such an only irresistible inference as, according to Y, no similar call had ever been made to her workplace prior to the incident, the phone call was made within a week after Posts 1 and 2 were published and that she did not have any dispute or grudge with anyone else except the Appellant and his girlfriend.

26.  The Magistrate accepted the prosecution witness’s evidence and rejected the explanation given by the Appellant in his video-recorded interviews, the Respondent submits that, even assuming the Interpretation is correct, there is nothing unsafe about the Appellant’s conviction in respect of Charge 2.

27.  The Appellant’s appeal shall therefore be dismissed.

Respondent’s grounds of appeal against the acquittal of Charge 1

28.  In Li Man Wai v Secretary for Justice[2], it was stated the relevant principles concerning an appeal by way of case stated under section 105 of the Magistrates Ordinance:

“18. An appeal by way of case stated under s.105 of the Magistrates Ordinance is not an appeal by way of rehearing. It is a review by the appellate court on the limited ground that there is an error of law or an excess of jurisdiction.”

29.  The Respondent now appeals by way of case stated against the acquittal of Charge 1 on the ground that the Magistrate erred in construing section 64(6)(c) of the PDPO (i.e. the Safety/Well-being Harm) as requiring the Respondent to prove that there must be some harm caused by the disclosure in the first place and that harm causes a data subject to be reasonably concerned (“Magistrate’s Interpretation”).

30.  The Respondent’s position is that, on a proper interpretation of section 64(6)(c) of the PDPO concerning the Safety/Well-being Harm, especially in the light of the legislative intent, what is required to be proven is that the material disclosure caused the data subject reasonably to be concerned for the person’s safety or well-being (i.e. just one layer of harm caused by the disclosure, as opposed to two layers of harm in the Interpretation)

31.  The Magistrate accepted the evidence of all prosecution witnesses, rejected the Defendant’s explanation given in the video recorded interviews, (P9, P10 and P11) and acquitted the Defendant of Charge 1 on the basis that the Prosecution, whilst having proven beyond reasonable doubt all the other elements of the offence under section 64(3C) of the PDPO, failed to prove that specified harm was caused to PW1 by the disclosure.

32.  However, the Respondent submits that the Harassment Harm adopted the wordings used in the injunction orders obtained by the Secretary for Justice from the High Court to restrain “doxxing” acts and the Safety/Well-being Harm adopted the wordings which form part of the elements of the offence of loitering under section 160(3) of the Crimes Ordinance, Cap. 200. According to section 64(6) of the PDPO, specified harm (指明傷害), in relation to a person, means harm causing the person reasonably to be concerned for the person’s safety or well-being. The Chinese version of the subject provision is “指明傷害 (specified harm) 就某人而言，指導致該人合理地擔心其安全或福祉的傷害”.

33.  At trial, it was common ground by Prosecution and Appellant that the Safety/Well-being Harm means the harm that the person has reasonably been caused to be concerned for his or her safety or well-being (i.e. a person sustains the Safety/Well-being Harm if he or she has reasonably been caused to be concerned for his or her safety or well-being because of the disclosure) (“Proposed Interpretation”).

34.  However, the Magistrate departed from the Proposed Interpretation and took a different interpretation and held that the Safety/Well-being Harm is a harm that caused the person reasonably to be concerned for the person’s safety or well, that somehow there has to be an “interim” harm caused by the disclosure and the “interim harm in turn caused the person reasonably to be concerned for his or her safety or well-being (i.e. the Magistrate’s Interpretation).

35.  In considering what the proper interpretation of the Safety/Well-being Harm should be, the Respondent stresses that the intent of the legislature in creating the new two-tier offences should be taken into account. As to what should be considered, it was held in HKSAR v Chen Keen and Others[3]:

(1) The context of the relevant statutory provision should be taken in its widest sense.

(2) It may be relevant and necessary, depending on the case, to consider the recommendation of a report such as that published by the Law Reform Commission, the explanatory memorandum to the relevant bill or a statement by the responsible official of the government in relation to that bill in the Legislative Council. It may also be relevant in any given case to look at the history of the provision concerned, and read it in the historical context of the situation which led to its enactment. The existing state of the law may also be relevant.

(3) Regard must also be had to the practical consequences of opposing constructions. Construction is an exercise in common sense and sound reason. The courts will presume that the legislature did not intend a statute to have consequences which are inconsistent with fundamental rights, or are objectionable or undesirable; or absurd; or unworkable or impracticable; or merely inconvenient; or anomalous or illogical; or futile or pointless.

36.  The Respondent stressed that at the outset of the PDPO that the Ordinance is “to protect the privacy of individuals in relation to personal data, and to provide for matters incidental thereto or connected therewith” and a right to privacy is enshrined under Article 14 of the Hong Kong Bill of Rights, which is based on the International Covenant on Civil and Political Rights (ICCPR) and is given constitutional status under Article 39(1) of the Basic Law.

37.  In addition, before the introduction of the new two-tier offences, it was an offence, under the previous section 64(2) of the PDPO, if a person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent and the disclosure causes psychological harm to the data subject.

38.  Thus, under the old regime, the only harm recognised/covered by the offence is “psychological harm”. To address members of the Legislative Council’s concern over the difficulty in assessing “whether the doxxing acts have in fact caused psychological harm to the data subject or his/her family members, which may result in acquittal of the defendant”, the two new offences under a two-tier structure (i.e. the offences faced by the Appellant; “New Doxxing Offences”) were introduced in the Personal Data (Privacy) (Amendment) Bill 2021 (“Report”)[4].

39.  As reflected under the new regime, specified harm is no longer restricted to psychological harm. Instead, four different types of harm are included under section 64(6) of the PDPO, namely:

(a) harassment, molestation, pestering, threat or intimidation to the person (對該人的滋擾、騷擾、纏擾、威脅或恐嚇) (i.e. the Harassment Harm);

(b) bodily harm or psychological harm to the person (對該人的身體傷害或心理傷害);

(c) harm causing the person reasonably to be concerned for the person’s safety or well-being (導致該人合理地擔心其安全或福祉的傷害) (i.e. the Safety/Well-being Harm); or

(d) damage to the property of the person (該人的財產受損) ( “Property Harm”).

40.  According to the Magistrate’s Interpretation, in order to prove the presence of the Safety/Well-being Harm, the Prosecution must prove two layers of harm: the disclosure must first cause some harm (“First Layer Harm”), and that First Layer Harm causes a data subject to be reasonably concerned (“Second Layer Harm”).

41.  However, for the following reasons, such an interpretation would result in absurdity and that the Safety/Well-being Harm could almost never be applicable in any doxxing cases:

1) Based on the Interpretation, in practical terms, the only possible scenario one can anticipate for the Safety/Well-being Harm to be applicable would be when the disclosure has caused the data subject the Harassment Harm, bodily harm or psychological harm and/or the Property Harm and the said harm has in turn caused the data subject reasonably to be concerned for his or her safety or well-being.

2) It is difficult, if not impossible, for there to exist a situation that would engage the Safety/Well-being Harm without the Court having to first be satisfied that the disclosure has caused the data subject the Harassment Harm, bodily harm or psychological harm and/or the Property Harm;

3) If the Interpretation stands, the Safety/Well-being Harm would become impracticable, redundant and purposeless as the Prosecution must in any event prove some other harm first, the presence of which could already result in the defendant being convicted of the offence under section 64(3C) of the PDPO.

4) The other three types of harm specified under section 64(6) of PDPO (i.e. the Harassment Harm, bodily harm or psychological harm and the Property Harm) are all harm caused by the disclosure. It supports the Proposed Interpretation which is consistent with the approach that specified harm for the purpose of the PDPO must be one that was caused by the disclosure without the requirement of any “halfway” harm; and

5) If the legislature found it necessary to narrow down (or to have defined) the scope of harm covered by the New Doxxing Offences, it would be absurd for them to leave the “harm” (i.e. the First Layer Harm) required under the Safety/Well-being Harm undefined.

42.  The Respondent submits that the Proposed Interpretation is to be preferred because:

1) It sits more naturally with the provisions under Section 64(3C)(b) of the PDPO (i.e. the disclosure causes “any specified harm” to the data subject etc., rather than causes some harm that causes specified harm).

2) It is also a construction which reflects the legislative intent in creating the New Doxxing Offences.

3) It is also consistent with an example was given by the Office of the Privacy Commissioner for Personal Data in its publication Implementation Guideline (October 2021) ( “Guideline”) about specified harm (c) of section 64(6) of the PDPO i.e. the Safety/Well-being Harm as follows[5]:

“Example:

Netizens disclosed the wedding date and venue of a complainant on an online forum and called for others to attend the wedding for ‘celebration’. The complainant was worried that the netizens would be incited to cause disturbance at the wedding.”

43.  On the correct interpretation of the Safety/Well-being Harm, the Respondent submits that, according to Bennion on Statutory Interpretation:

“The court seeks to avoid a construction that produces an absurd result”

“The strength of the presumption against absurdity depends on the degree to which a particular construction produces an unreasonable result”

“… the presumption against absurdity means that the courts will generally avoid adopting a construction of an enactment that produces an unworkable or impracticable result”; and

“Where the enactment is grammatically ambiguous, the court favours a meaning that is workable even where it is grammatically less apt. in Gill v Donald Humberstone & Co Ltd.”

44.  Thus, the Prosecution’s position is that, for the Safety/Well-being Harm to be established, what is required to be proven is that the material disclosure caused the data subject reasonably to be concerned for his/her safety or well-being, as opposed to having to additionally prove the First Layer Harm (i.e. the Proposed Interpretation).

45.  As to what amounts to the Safety/Well-being Harm, the Respondent maintains the proposition that it is to a large extent similar to one of the elements of the loitering offence under section 160(3) of the Crimes Ordinance, Cap. 200, i.e. causing a person reasonably to be concerned for his/her safety or well-being[6].

46.  The Respondent’s Proposed Interpretation of the Safety/Well-being Harm is more in line with the legislative intent to “curb doxxing behaviours more effectively”. The first reason is that not all doxxing posts include elements of harassment, threat etc. In addition, as mentioned in the Report, “public figures”, for example, “may be more resilient to doxxing with no apparent psychological harm caused to them”. If, for the Safety/Well-being Harm to be established, two layers of harm must be proven, a lot of doxxing activities would not be covered by the more serious offence under section 64(3C) of the PDPO.

47.  Therefore, based on the Magistrate’s ruling:

(1) The Appellant did disclose the personal particulars of PW1.

(2) The Appellant intended to cause specified harm, namely the Harassment Harm and the Safety/Well-being Harm to PW1.

(3) PW1 “must be, understandably, reasonably concerned over his safety or [well-being]” as a result of the Defendant’s disclosure.

The Magistrate should therefore convict the Appellant of Charge 1 upon finding that PW1 was reasonably concerned for his own safety or well-being, and there should be no dispute that PW1 was indeed concerned as not only had he asked the security guard in his building to enhance security, he had also changed the lock on the entrance door of the Flat.

48.  On a proper interpretation of section 64(6)(c) of the PDPO concerning the Safety/Well-being Harm, especially in the light of the legislative intent, what is required to be proven is that the material disclosure caused the data subject reasonably to be concerned for the person’s safety or well-being (i.e. just one layer of harm caused by the disclosure, as opposed to two layers of harm in the Interpretation).

49.  As the Respondent has already proven beyond reasonable doubt all the elements of the offence under section 64(3C) of the PDPO. The Magistrate shall convict the Appellant of Charge 1 as well.

Respondent’s submissions to the Court’s enquiries

50.  Further, in response to the Court’s enquiry at the hearing on 30 May 2025, the Prosecution addresses the four questions raised:

(1) Set out more about the legislative and historic background of the New Doxxing Offences in order to establish why the Proposed Interpretation should be adopted with reference to what the Magistrate referred to at paragraph 49 of the signed case (Question 1);

(2) State with clear reasons why the Prosecution says the Magistrate’s Interpretation is absurd (Question 2);

(3) Explain the relevance of the Safeguarding National Security Ordinance and the wording of the loitering offence in considering why the Magistrate’s Interpretation should not be adopted (Question 3); and

(4) State the Prosecution’s stance on what caused the data subjects to be reasonably concerned about their safety/well-being (Question 4).

51.  On question 1, before the New Doxxing Offences came into effect on 8 October 2021, the previous section 64(2) of the PDPO provided that a person commits an offence if (i) the person discloses any personal data of a data subject which was obtained from a data user without the data user’s consent, and (ii) the disclosure causes psychological harm to the data subject. Thus, under the old regime, the only harm being recognised was “psychological harm” caused by the material doxxing activities.

52.  In the Legislative Council Brief on the Personal Data (Privacy) (Amendment) Bill 2021 dated 14 July 2021, the Constitutional and Mainland Affairs Bureau explained the “justification” for the creation of the New Doxxing Offences:

“Despite the Government and the Office of the Privacy Commissioner for Personal Data’s (‘PCPD’) proactive efforts in carrying out enforcements under the [PDPO], the offences under the existing section 64 of the PDPO regulate disclosure of personal data obtained from a data user without the data user’s consent and is not intended for addressing the doxxing acts committed in recent years.”

In the Report, it was further explained why the two-tier offences were created:

“3. Since June 2019, there has been an upsurge of doxxing activities in which personal data is often dispensed and reposted repeatedly on online platforms. As the existing section 64 of Cap. 486 is not intended for addressing the doxxing cases in recent years, the [PCPD] and the Police often encounter great difficulties in tracing the source of the doxxing contents to ascertain (i) the identity of the data user; and (ii) whether the personal data was obtained from the data user without the data user’s consent. In order to curb doxxing behaviours more effectively, the Administration proposes to introduce new offences under Cap. 486 as well as new enforcement powers of the Privacy Commissioner for Personal Data …

…

21. Some other members opine that it is difficult to assess whether the doxxing acts have in fact caused psychological harm to the data subject or his/her family members, which may result in acquittal of the defendant. For example, public figures may be more resilient to doxxing with no apparent psychological harm caused to them. The Administration has advised that when the Panel on Constitutional Affairs was consulted on the proposed legislative amendments, members expressed concern over the high threshold of ‘causing psychological harm’. As such, two new offences under a two-tier structure are introduced in the Bill. Besides, in determining whether the disclosure has caused ‘psychological harm’ to the data subject, the Court will take into account forensic evidence such as the data subject’s psychological report and medical practitioners’ advice.”

53.  The Respondent pointed out that the New Doxxing Offences were created in order to:

i) address the doxxing cases in recent years not covered by the previous offence;

ii) curb doxxing behaviours more effectively; and

iii) address the high threshold of “causing psychological harm”.

54.  Also, in the Official Record of Proceedings of the Legislative Council of 29 September 2021, there was extensive discussion on the then proposed New Doxxing Offences, including that the New Doxxing Offences are targeted at combating the dissemination of doxing information and also persons who commit doxxing with the intention of causing specified harm to the data subject or his family members or with reckless disregard for whether any such harm will be caused to them.

55.  It is apparent from the legislative background that the Safety/Wellbeing Harm only requires the data subject reasonably to be concerned about the data subject or his/her family members’ safety and well-being, as evidenced by the above example given in the Guideline.

56.  Question 2, in 香港特別行政區 訴 張子良[7], one of the appeal grounds was that the Safety/Wellbeing Harm required an additional layer of harm to be proved. The court correctly rejected the appeal ground and held that it is sufficient that the doxxing activity caused the data subject reasonably to be concerned for his safety or well-being.

57.  Secondly, the Magistrate singled out the Safety/Well-being Harm as the only kind of specified harm that requires the proof of two layers of harm. In the signed case stated, the Magistrate took the view that

“Although the statutory language used in Section 64(6)(c) of the PDPO recognised all forms of harm, in order not to overstretch the scope, the legislation only attached criminal liability to disclosures which caused harms with sufficient magnitude and severity i.e. harms causing the person reasonably to be concerned for his/her safety or well-being. I was of the view that such interpretation was operative, and no absurdity was caused”

However, such a view is not supported by any of the abovementioned legislative papers or authorities.

58.  One of the reasons why the New Doxxing Offences were introduced was to address the high threshold of “causing psychological harm” as “the Court will take into account forensic evidence such as the data subject’s psychological report and medical practitioners’ advice”. The threshold is considered high as not all victims of doxxing activities would necessarily suffer from such harm.

59.  Question 3, the Respondent made reference to the Safeguarding National Security Ordinance (Instrument A305) because under section 119(4)(b), the definition of the Safety/Well-being Harm under the PDPO is largely adopted.

60.  As to the reference to the wording of the loitering offence, it is submitted that the Safety/Well-being Harm adopted the wordings which form part of the elements of the loitering offence under section 160(3) of the Crimes Ordinance, Cap. 200, and the relevance of it goes to how the Court is to assess whether the data subject is reasonably concerned for his/her safety or well-being. In fact the Defence accepted such proposition and the Magistrate did adopt the suggested approach in his statement of findings.

61.  Question 4, in law, under section 64(3C) of the PDPO, it must be the material disclosure (in the present case that would be Posts 1 and 2 published by the Defendant) which causes the Safety/Well-being Harm to the data subjects. The Court could consider the nature and extent of personal data disclosed in both posts (before and after updates), the wording of the posts, the nature of the platform on which they were published and the comments made by the Appellant or interaction the Appellant had with other group members.

62.  Therefore, based on the Magistrate’s ruling, the Appellant should be convicted of Charge 1 on finding that PW1 was reasonably concerned for his own safety or well-being, and there should be no dispute that PW1 was also indeed concerned as not only had he asked the security guard in his building to enhance security, he had also changed the lock on the entrance door of the Flat.

63.  The Appellant did not file any written submissions to oppose the Respondent’s appeal, despite opportunity had been given to him on 30 May 2025.

Consideration

64.  In the Court of Final Appeal case, HKSAR v Hui Lai Ki [8], it was stated that the Magistracy Appeal is conducted by way of rehearing on the evidence before the trial court. The judge must be satisfied that the appellant’s guilt has been proven beyond reasonable doubt on the evidence, failing which the appeal must be allowed. On such rehearing, if the judge comes to a different view on the evidence before the court, that itself is an error which justifies appellate intervention to reverse the decision of the magistrate to convict.

65.  The Court recognised that an appellate court conducting a rehearing would be subject to limitations arising from the fact that it does not have the advantage of receiving witnesses evidence first-hand. Hence, it must exercise caution when considering findings of fact based on oral testimony. Yet, despite those limitations, it remains the duty of the appellate court on appeal by way of rehearing to come to its own conclusion on disputed issues of fact or law.

Appeal against conviction by the Appellant

66.  On ground 1 about the amendment of the charge after plea taken, as stated about in Tse So So[9], the Magistrate did have the general power to grant the amendment and the Appellant also fails to point out any prejudice suffered, this ground must fail.

67.  On ground 2 about the sufficiency of evidence, the Magistrate did take into account the fact that the Appellant owned and used the relevant Facebook account and did publish Posts 1 and 2 containing personal data of PW1 and PW2 of which the details were extensive and precise enough to lead to the identification of them. The data of which clearly went beyond showing craftsmanship, including their names, employer of X, occupation of Y, full address of the Flat, X’s mobile number and with recording video. The posts also contained messages including “get it done by smashing everything inside the house”, “there are still some trash and broken planks … throw there”, “can play big … concerning Charming Garden”, “can count me in to rip out stuff. Free of charge”, and the Appellant saying “Thank you, bro”.

68.  Apart from the posts, there had been calls for repayment of money, or calls that no one spoken on the other side. X also confirmed the post affected his mood, he had to change the lock on the entrance door and asked the security guard to enhance the security. As to Y, there had also been phone call made to the workplace demanding the kindergarten to dismiss her or put up poster around to publicize the matter.

69.  Y had great concern about her safety and well-being, and it also affected how the subordinate and the parents to view her. Y also informed the security guard to be aware and forbid strangers to go up to the Flat. By all the above evidence, it would be more than clear and sufficient evidence for X and Y to be reasonably concerned about their safety or well-being.

70.  Therefore, upon rehearing, I am also satisfied that both charges had been proven beyond all reasonably doubt, and the appeal against conviction of both charges be dismissed accordingly.

Appeal by way of case stated by the Respondent

71.  By referring to the enactment history of the regulation, as fully stated above, the high threshold of proving psychological harm was called into question, which led to the new amendments for two-tier structure introduced to curb doxxing behaviours more effectively. It is indeed quite apparent that it only required the prosecution to prove the data subject to be concerned about his/her or family members’ safety and well-being.

72.  The additional layer of harm as imposed by the Magistrate was not supported by any legislation documents or authority. Now as the Appellant did disclosure the personal particulars of X. The Appellant did intend to cause harm to X’s safety and well-being, and X must be so concerned as evidence disclosed above. The Appellant shall also be convicted on Charge 1 instead of the lesser offence.

73.  Therefore, the case shall be remitted to the same Magistrate to convict on the amended Charge 1 instead of lesser charge and to sentence the Appellant accordingly.