A major American private equity firm is set to acquire Moneris, a leading Canadian payment processing company handling a significant share of transactions in the country. The Royal Bank of Canada and Bank of Montreal recently disclosed their joint decision to sell Moneris to Francisco Partners for $2 billion, resulting in a positive market response with shares of both banks rising post-announcement. Royal Bank of Canada anticipates a $475 million gain from the transaction, while Bank of Montreal expects to secure $600 million. Despite the financial benefits, concerns have been raised by industry analysts regarding potential adverse effects on Canada’s digital sovereignty, particularly in light of the ongoing trade tensions with the United States.
The concept of digital sovereignty revolves around a nation or individual’s ability to maintain authority over their digital assets. In September, AI Minister Evan Solomon emphasized the necessity for Canada to establish a sovereign digital economy free from external influence. A group of experts and academics echoed similar sentiments in an open letter to Prime Minister Mark Carney, urging swift action to safeguard Canada’s digital sovereignty amid the changing landscape.
Sharon Polsky, President of the Privacy and Access Council of Canada, expressed apprehension over the deal, emphasizing the significance of protecting Canadians’ data integrity. With Moneris servicing numerous businesses in Canada and processing billions of transactions annually, Polsky highlighted the potential risks of sensitive data being accessible to foreign entities, including law enforcement agencies.
The transaction’s timing amid trade tensions between Canada and the U.S. has fueled concerns about the possible leverage of transaction data in trade negotiations. Polsky and Independent Canadian Senator Colin Deacon both raised alarms about the implications of U.S. ownership of a Canadian payment processing platform on data security and privacy.
While both banks and Moneris have affirmed their commitment to Canadian businesses post-acquisition, the lack of robust privacy legislation in Canada poses challenges. Polsky underscored the necessity for stronger privacy laws to protect data sovereignty and prevent potential scenarios where Canadian companies may be compelled to comply with foreign regulations over domestic laws.
In response to these concerns, the Canadian government introduced Bill C-36, aimed at enhancing digital privacy protections and updating existing privacy frameworks. The bill includes provisions requiring companies to conduct privacy impact assessments before transferring personal data outside Canada, emphasizing the importance of safeguarding data integrity. Despite these legislative efforts, critics like Polsky believe that more comprehensive measures are needed to ensure data sovereignty and security in the digital landscape.