HONG KONG -- A data protection bill that has raised alarm with Facebook, Twitter and other global internet platforms looks set to be endorsed by Hong Kong's Legislative Council on Wednesday.
The bill is targeted at "doxxing" -- the act of putting others' personal information online so that they can be harassed. This was a widespread practice among some activists on both sides of the political divide during the city's 2019 anti-government protests.
The draft law would criminalize such disclosures and give the city's Privacy Commissioner for Personal Data powers to launch criminal investigations, seize evidence even without a warrant and prosecute cases. Violators of the law could face penalties of up to five years' imprisonment and fines of 1 million Hong Kong dollars ($128,000).
Technology companies are concerned as provisions of the bill could make their staff liable for prosecution over content on their platforms.
While legislators are due to consider a few minor tweaks to the bill on Wednesday, officials have largely set aside suggestions and concerns raised by the tech industry and lawyers' groups. Given the current lack of opposition lawmakers, and establishment legislators' comments on expanding the bill's reach, few doubt it will sail through the two votes needed for enactment.
"At this time, in this kind of environment, there is very little [tech companies] can do about the way the law is legislated," said Charles Mok, who represented the information technology sector in the Legislative Council, or Legco, until last year. "They have aired their concerns, they have said what they needed to say."
Mok, who quit with 14 colleagues after four of their peers were ejected, now runs Tech for Good Asia, an industry forum for addressing technology-related issues that did not officially comment on the bill.
"I didn't really think it would make a difference," Mok said.
Those who did flag worries about the bill include the Law Society of Hong Kong and two tech groups, the Asia Cloud Computing Association (ACCA) and the Asia Internet Coalition (AIC).
Google and Amazon.com are members of both groups. Microsoft and Oracle are in the ACCA while the AIC includes Apple, Facebook, Line, LinkedIn, Yahoo and Twitter. The Internet Society's Hong Kong chapter also publicly raised objections earlier.
For the lawyers, "the most serious concern we have with the amendment bill is that apparently it takes away the right of an accused to remain silent," the Law Society said in reference to a provision making it a crime to not cooperate with a doxxing investigation. Elsewhere in its Legco submission, the society criticized the draft bill's wording as "amateurish and, on the other [hand], dangerously wide."
The ACCA focused its demands on exempting cloud platforms from official orders to remove content. It cautioned that the bill's wording could require the "complete suspension of all service offerings used by [a] client." It went on to say such a "disproportionate response" could violate service contracts.
The AIC also pleaded for excluding internet platforms and their local subsidiaries from potential criminal prosecution.
"Intermediaries are neutral platforms with no editorial control over the doxxing posts, and are not the persons making the posts," the group said in its submission. "Penalizing platforms for their users' doxxing actions, over which platforms have no control, is a very extreme outcome."
The AIC, though, also took wider aim at how the bill's target had shifted from an initial proposal in May focused on punishing doxxing that harms people. The bill now covers acts that are merely "reckless" or "intended" to cause harm.
Aside from the mention of intent, the group said, "There is nothing else in the language of the offense that would clearly prevent it from being used as a tool for censorship, or be otherwise misused to criminalize everyday activities involving harmless disclosure of another person's personal data (e.g., mentioning a name or posting a photo online)."
Jeff Paine, the AIC's managing director, declined repeated requests to discuss how Legco and the government had dealt with the group's concerns. Instead, he said in a statement that members "remain committed to continue working with the [Privacy Commissioner] for the advancement of data protection in Hong Kong."
Representatives of Facebook and Twitter also declined to comment on the shaping of the bill.
According to Facebook's "Transparency Center," the company acted to restrict Hong Kong access to 13 content items between July and December 2020, but none related to personal data.
In its own report, Twitter said it had received 15 legal demands to remove content in Hong Kong over the same period and separately stated that it "received multiple legal demands from Hong Kong police in relation to allegations of unlawful and obscene activities against members of law enforcement."
It said it did not act on the police complaints as the content did not violate its terms of service.
"As the bill has been hastily finalized, steps must be taken to allay the concerns of industry players and ensure that the implementation does not cause any unintended and undesirable effects," said Kenn Yee, a tech policy analyst with Access Partnership.
"Regulators should hold dialogues with stakeholders to clarify and ease concerns, and gather feedback on how the regulations can be implemented and used appropriately," he added.
