The Asia Internet Coalition, which includes Facebook and Google, has said its constituent companies may have to cease operations in Hong Kong if a new privacy law is passed.
The proposed law falls into the massively controversial national security law that sparked protests across the region and has so far lead to over 120 arrests.
What does the new law say?
The proposed changes to the law would give local authorities in Hong Kong the ability to force social media companies to remove or delete personal information from their platforms.
Further, at a legislative council meeting referenced in the open letter penned by the Asia Internet Coalition, the group suggested that the PCPD (Hong Kong's privacy commissioner's office) or the Administration may be able to prosecute employees of big tech companies if they failed to comply with a 'rectification notice'.
What's more, although there is an appeals mechanism for such a notice, "any person being served with the Rectification Notice is required to first comply with the notice within the designated time frame pending the outcome of the appeal, and failure to do so could expose the employees of intermediaries to criminal prosecution".
What's provoked the change?
The new law is allegedly going to be used to combat an activity called doxxing. 'Doxxing' someone, in short, essentially means posting their personal, identifiable information online, and can include home addresses and telephone numbers.
Doxxing in Hong Kong has been a major issue since 2019, when pro-democracy protests swept the region. Actors on both sides maliciously released the personal information of protestors, police officers, and journalists.
The Hong Kong authorities, in an attempt to dampen the furor around the bill, have attempted to clarify that the action will only be taken against 'illegal doxxing'.
What did the AIC say?
The Asia Internet Coalition is a trading association consisting of some of the biggest technology companies on earth. Members include Apple, Amazon, the Expedia Group, LinkedIn, Rakuten, Facebook, Google, Twitter, Airbnb, Yahoo, and CloudFlare.
The AIC raised several issues with the proposed legislation in an open letter penned to Ms Ada Chung Lai-ling, Hong Kong's Privacy Commissioner for Personal Data. The group's position rests in questioning the legal basis for holding employees of social media companies personally liable for users' posts.
The first problem the AIC identified is the lack of a real definition of the term doxxing and the corresponding implication that it could be applied in a dangerously broad set of circumstances. They suggest establishing legitimate situations where data can be disclosed, such as when it is in the public interest. But the main issue is of course the threat that employees may be prosecuted for not complying with demands:
The proposal to subject such platforms to criminal liability is unnecessary and excessive, noting that these platforms are just making the service available to users for posting and should not be penalized for their users' doxxing actions over which the platforms have no control
The consequences of such actions are perhaps best summed up in one of the closing recommendations, where the AIC says that "introducing severe sanctions and especially personal liability in relation to assessing requests for taking down content has the consequence of encouraging online platforms to conduct little to no review of requests and over-block content, which will likely result in grave impact on due process and risks for freedom of expression and communication".
How has the Hong Kong government responded?
Chief Executive of Hong Kong, Carrie Lam, criticized reaction to the proposed legal changes, likening it to the way the national security law was "slandered and defamed".
Lam told reporters that her government will be "targeting illegal doxxing and empowering the privacy commissioners to investigate and carry out operations, that's it", but suggested a meeting with the tech companies in question "would be ideal to relieve this anxiety when we make the legislation. But sometimes it needs to be demonstrated via implementation".