Protecting the right to privacy against doxxing: injunction as the only effective means
Doxxing refers to the act of researching one’s private information (e.g. home address) and then exposing it publicly (usually by posting it on the internet). It is a form of cyber-harassment. In Hong Kong, given the recent political upheaval, the police are on bad terms with some citizens. There is distrust and dislike between them. As a result, police officers (including their family members) have had their private information posted publicly. The most effective means to protect against doxing is the use of injunctions against access to public registers. However, this solution is not sustainable.
There is a publicly accessible register containing personal information of all registered voters in Hong Kong. The register is designed for voters to verify their eligibility and belonged constituency. This register is a potential source of abuse by doxxers, who can use it to identify the police’s exact residential addresses. In the recent Hong Kong Court of Appeal decision of Junior Police Officers’ Association of The Hong Kong Police Force v. Electoral Affairs Commission and Others  HKCA 1197, a group of police officers petitioned for an interim injunction, restraining the register from being publicly accessible. The Court granted the injunction.
In its judgement, the Court emphasized the importance of protecting privacy, which is enshrined in Art.14 of the Bill of Rights. It held that access to the register facilitated a real, imminent and substantial risk of doxxing. In relation to the impact on elections, the Court held that restraining access to the register will not affect the integrity of the election, this is because the register is mainly for verifying whether one has duly registered – voters have other means of checking this. According to the Court, a fair balance between the right to privacy and access to the register tilted towards protecting privacy.
Moreover, although there are existing criminal provisions against the misuse of information contained in the register, the Court was of the opinion that doxxers would not be deterred. Furthermore, criminal sanctions will be too late, as irreparable harm would have already been done by doxxing. The Court added that the threat of doxxing would deter individuals from registering as voters – more reason to grant the injunction.
Injunction as the only effective means
The Court expressly held that criminal sanctions are ineffective, because ‘doxxers, by definition, do not respect or abide by the law’. Accordingly, the use of injunctions is the only practically effective means of dealing with the threat of doxxing.
The reliance on injunction has profound implications. First, the injunction is imposed on an innocent third party (i.e. a non-doxxer), which is the government department responsible for the register. Whilst this is legally acceptable (injunctive relief against third parties are not unheard of in other contexts; see also the Google case), the implication is that a non-infringer is suddenly burdened by the injunction, and is faced with the potential consequence of criminal contempt of court on breach. Second, resources have to be devoted to complying with the injunction, and (substantial) legal costs may be incurred. Furthermore, it remains uncertain if the injunction holder can sue the third party based on contempt on breach (though there is no duty of care).
The reliance on injunction is not a sustainable solution. This is because, given that almost every crime will have irreparable harm, it is untenable to restrain all third parties in the future who unwittingly become sources of crime (doxxing in this case. Though sensible in the circumstances of this case, the use of injunctions may undermine the authoritativeness of using criminal sanctions to deter and punish doxxing. Moreover, an injunction imposed on a non-infringer is more draconian than one imposed on a wrongdoer.
Nevertheless, injunction may be the only viable solution against doxxing. To lessen its adverse impact, however, actions should be taken by both the executive and the legislature. For the executive, the Court has rightly urged the government to take action to deal with the threat of doxxing. For the legislature, it should carefully deliberate on whether additional statutory safeguards should be in place to prevent any third party from being over-burdened. Legislating the use of injunctions would give this solution the authoritativeness to justify its tremendous impact on third parties.