Protection Against Online Fraud Act

Summary#

Bill C-288, the Protection Against Online Fraud Act, would create a new Act and amend the Criminal Code. Its stated goal is to require platform operators to prevent fraudulent content from spreading and notify users who engaged with it. The supplied text is a proposal; it does not show that these provisions are in force.

• Platform operators would have to take reasonable steps to prevent fraudulent content, remove content identified as fraudulent, and notify users they know or should reasonably know engaged with it. They must ensure the user has read the notice.
• Operators would have to keep records of removed content and notices, and publish reports with information set by regulation.
• An operator convicted of contravening these duties could face a fine of up to $1 million on summary conviction. A due-diligence defence would apply.
• For identity-theft or identity-fraud offences under the specified Criminal Code sections, a court would have to consider the victim’s vulnerability, including their age, health and financial situation, as an aggravating circumstance when sentencing.

What it means for you#

• Platform owners and operators: The duties would apply to owners or operators of internet-connected platforms, including social media and online video gaming services. The bill does not set out how operators must decide whether content is fraudulent.
• Platform users: If an operator knows or should reasonably know you engaged with content identified as fraudulent, it must notify you and ensure you have read the notice. The bill does not promise that every user exposed to fraudulent content will be identified.
• People affected by identity theft or identity fraud: If someone is convicted under the specified Criminal Code sections, the court must consider the victim’s personal vulnerability when sentencing. The bill does not require a particular sentence or increase.
• General public: The bill does not create a public fraud-reporting service or a new independent regulator.

Money#

No publicly available information.

• The bill would require operators to spend on prevention measures, notices, record-keeping and reports, but it gives no cost estimate.
• Regulations could set record and reporting requirements; the bill gives no estimate of the cost of making or administering those regulations.
• The maximum fine is $1 million on summary conviction. The bill does not estimate fines or revenue.

What is unclear#

• “Fraudulent content” is not defined, and the bill does not say who identifies content as fraudulent or how an operator can challenge an identification.
• The bill does not set out what steps count as reasonable, or how an operator must ensure a user has read a notice.
• Regulations would set report details and form, and could address records. The bill does not set out those details, deadlines, or an oversight process.
• The bill gives no start date. Its passage is uncertain.
• The current Criminal Code text was not supplied, so the existing law and the exact change to sentencing could not be verified.

Case for#

• The bill appears intended to reduce the spread of online fraud by requiring operators to take preventive steps and remove content identified as fraudulent.
• Notifying users who engaged with such content could alert them to a risk they might otherwise miss.
• Record-keeping and public reports could make operators’ responses more visible.
• Requiring courts to consider a victim’s vulnerability could ensure that personal circumstances are part of sentencing decisions.

Case against#

• The bill does not define “fraudulent content” or say who identifies it. Operators could face uncertainty about what they must remove.
• The duty to ensure a user has read a notice may be difficult to meet, but the bill gives no method or standard for doing so.
• The duties could impose costs on operators, but the bill provides no estimate and leaves important reporting details to regulations.
• A court must consider vulnerability as an aggravating circumstance, but the bill does not define vulnerability beyond examples or explain how it should affect a sentence.