Deutsch
English
Español
Français
Nederlands
Português
Dutch Government Prohibits American Acquisition of Critical Digital Infrastructure Provider
The Dutch government has formally blocked the acquisition of Solvinity, the cloud company that operates the country's critical DigiD digital identity system, by American IT giant Kyndryl. State Secretary for Economic Affairs Willemijn Aerdts announced the prohibition on May 26, 2026, citing risks to the public interest and national security under the Wet ongewenste zeggenschap telecommunicatie (WOZT). The decision follows a thorough investigation by the Bureau Toetsing Investeringen (BTI), which advised that the takeover posed unacceptable risks to the Netherlands' digital sovereignty.
Solvinity, originally a Dutch company now under British ownership, manages the secure storage and exchange of sensitive personal data used by DigiD. The platform enables millions of Dutch citizens to interact with government services including the Tax and Customs Administration, healthcare insurers, and pension funds. In 2024 alone, DigiD processed over 550 million authentications, and by 2025, MijnOverheid counted 11.7 million active accounts.
National Security Concerns Behind the Block
The BTI's risk assessment highlighted that under U.S. laws such as the CLOUD Act, American authorities could potentially demand access to data held by Solvinity, including the personal information of Dutch citizens. This raised alarms among cybersecurity experts and lawmakers in the Tweede Kamer, who had previously urged the government to prevent the transfer of control over DigiD to a foreign entity subject to extraterritorial legislation.
State Secretary Aerdts emphasized that the decision was not taken lightly. 'It is a decision I did not take lightly, because intervening in the market is a heavy measure,' she stated. 'But the fact that we could not eliminate the risks and could not guarantee the public interest made intervention necessary.' The BTI's review was described as country-neutral, risk-based, and proportional, focusing solely on this specific transaction.
Kyndryl Reacts With Disappointment
Kyndryl, the New York-headquartered IT infrastructure services company that was spun off from IBM in 2021, expressed deep disappointment with the ruling. In a statement, the company said it was 'extremely disappointed' and accused the Dutch government of 'politicizing' the process. Kyndryl had previously assured Dutch authorities that no data would be at risk and that it had cooperated in good faith with the investigation. The company may still pursue legal avenues to challenge the decision.
Journalist Eric Smit, who along with Joris Luyendijk and Sander Schimmelpenninck initiated a lawsuit against the takeover, called the block 'very good news' for Dutch digital sovereignty. A petition opposing the acquisition gathered nearly 200,000 signatures.
Contract Uncertainty Beyond 2028
The current contract between the Dutch government and Solvinity runs until August 2028, having been extended by two years amid earlier concerns. State Secretary Aerdts declined to comment on future arrangements, stating that it was too early to discuss next steps. The government has also been exploring alternatives, including partnerships with German cloud providers to reduce dependency on American technology.
The decision highlights broader European concerns about foreign control over critical digital infrastructure. The Netherlands, like many EU nations, is heavily reliant on American tech companies for cloud services and digital tools. Similar to the EU's digital sovereignty push, the Solvinity block underscores a growing trend of governments asserting control over strategic digital assets.
Implications for Dutch Digital Autonomy
Experts in critical infrastructure protection have praised the move as a necessary step to safeguard national security. However, questions remain about the long-term strategy for DigiD and other government digital services. The block may also affect investment sentiment among foreign tech companies operating in the Netherlands, though Aerdts stressed that the Netherlands values the presence of international technology firms.
The case sets a precedent for how European nations can use investment screening laws to protect national security and public interest in the digital age. With the contract ending in 2028, the Dutch government faces a tight timeline to secure a sustainable and sovereign solution for its digital identity infrastructure.
Frequently Asked Questions
What is Solvinity and why is it important?
Solvinity is a cloud services provider that manages the IT infrastructure for DigiD, the Netherlands' digital identity system used by millions to access government services. It also handles MijnOverheid and secure communications for the Ministry of Justice and Security.
Why did the Netherlands block the takeover?
The Dutch government blocked the acquisition under the Wet ongewenste zeggenschap telecommunicatie (WOZT) because U.S. laws like the CLOUD Act could allow American authorities to access sensitive Dutch personal data, posing a risk to national security and the public interest.
What happens to DigiD now?
The current contract with Solvinity remains in place until 2028. The government has not yet announced a long-term solution but is exploring alternatives to reduce dependence on foreign providers.
Can Kyndryl appeal the decision?
Yes, Kyndryl has indicated it may take legal action against the prohibition. The company has expressed 'extreme disappointment' and claims the process was politicized.
How does this affect Dutch citizens?
For now, there is no immediate impact on DigiD users. The system continues to function normally. The block ensures that sensitive personal data remains under Dutch oversight and is not subject to extraterritorial U.S. data access laws.
Follow Discussion