Dutch Parliament AGAIN Demands Government Protect DigiD From American Takeover

A majority in the Dutch parliament has again instructed the government to prevent DigiD, the national digital identification system, from ending up in American hands. The renewed demand comes as US company Kyndryl moves closer to acquiring Solvinity, the Dutch firm that manages the servers on which DigiD runs.

Millions of Dutch residents use DigiD daily to access government services including the Tax Authority, municipalities, health insurers, and pension funds. While the government agency Logius built and manages DigiD itself, the underlying server infrastructure is operated by Solvinity, which is now being acquired by Kyndryl, an IT services company spun off from IBM.

"We simply do not want this to end up in American hands. Period," said GroenLinks-PvdA parliamentarian Barbara Kathmann, whose motion received majority support in the Tweede Kamer.

According to experts, American ownership of DigiD's infrastructure poses two specific threats. First, under the US CLOUD Act of 2018, the American government can demand access to data held by US companies, even when that data is stored outside the United States. This could potentially expose sensitive Dutch citizen data to American authorities.

Second, the US government could effectively shut down DigiD by ordering an American company to stop providing services to the Netherlands. This is not a theoretical concern. Last year, President Donald Trump banned American companies from providing services to the chief prosecutor of the International Criminal Court in The Hague, demonstrating willingness to use such measures as a political tool.

"If the acquisition goes through and Trump decides he finds the Netherlands troublesome, he could order an American company to stop doing business with the Netherlands. Then DigiD could be switched off," warned tech expert Ben van der Burg. "This is really dangerous, and the Netherlands is terribly naïve."

Parliament wants the responsible minister to intervene. If Kyndryl does take over Solvinity, MPs are demanding that DigiD's servers be moved to another Dutch, or at least European, company.

"When the contracts expire, we'll bring back those assignments and award them to a Dutch party," Kathmann said. She hopes that signalling this intention will make the acquisition less attractive for Kyndryl, potentially causing the deal to fall through entirely.

This is not the first time parliament has raised the alarm. MPs previously instructed the government to protect DigiD in January, following a technical briefing where experts outlined the risks. VVD parliamentarian Silvio Erkens expressed deep concern that the acquisition could "enable the U.S. government to access data" and potentially use it to blackmail people.

Tech experts have identified two legal mechanisms the Dutch government could use to stop the acquisition. The Undesirable Control of Telecommunications Parties Act allows the government to block an acquisition if it poses a threat to public interest, for example if the new owner is under the influence of a country that may deliberately cause service outages.

The Foreign Acquisitions Review Act (Vifo) allows the government to stop a purchase if the new owner poses a risk to national security. The Bureau Toetsing Investeringen (BTI), an independent regulator, is currently investigating the acquisition under this act, though the process could take several months.

The Firewall Foundation, a group of tech experts, has formally requested that the Ministry of Economic Affairs assess the acquisition under both acts. "Kyndryl has no chance, if you ask me. The whole of society is digging in its heels," said journalist Eric Smit, speaking on behalf of the foundation.

Adding to parliamentary frustration, it emerged last month that a Dutch investor had attempted to acquire Solvinity but was narrowly outbid by Kyndryl. With just a few million euros more, DigiD could have remained in Dutch hands.

"Parliament was clear: we must remain in control of our own data," Kathmann said. "That there was a serious option to keep DigiD Dutch and that it was passed over is therefore absurd and incomprehensible."

The DigiD contract with Solvinity runs until August 2028, giving the government time to transition to an alternative provider if it chooses to act. Logius, the government agency responsible for DigiD, has indicated it aims to develop a Dutch government cloud that would eliminate dependence on commercial parties entirely.