Dutch Digital Sovereignty at Risk in Planned US Takeover of DigiD Host
The Hague, Thursday 15 January 2026
A coalition of experts warns the Dutch government that selling Solvinity to US-based Kyndryl threatens national security. With the infrastructure for DigiD at stake, critics argue this acquisition exposes 16.5 million citizens to foreign surveillance and potential service blockades, describing the deepening reliance on American technology as a ‘state of emergency’.
Demanding Transparency in Critical Infrastructure
A prominent coalition of Dutch privacy advocates, legal scholars, and technology experts has formally demanded transparency regarding the acquisition of Solvinity by the American multinational Kyndryl [1][2]. In a letter sent on Monday, 12 January 2026, to the Bureau Toetsing Investeringen (BTI), the group urged the Ministry of Economic Affairs to clarify whether this transaction is being scrutinised under the Investments, Mergers and Acquisitions Security Screening Act (Wet Vifo) [4]. Solvinity manages the underlying platform for DigiD, the national digital identity system designated as a vital service for Dutch citizens to access government agencies, insurers, and healthcare providers [4][5]. The acquisition, first announced in November 2025, has raised alarms that transferring this critical infrastructure to a US-owned entity subjects it to extraterritorial American laws, potentially compromising the privacy and sovereignty of Dutch data [1][3].
Geopolitical Leverage and the ‘Crowbar’ Effect
The primary concern voiced by the experts is the legal reach of the US government, specifically through mechanisms like the Cloud Act, which could compel American companies to surrender data regardless of where it is stored [2][4]. Reijer Passchier, a professor of digitalisation and the democratic constitutional state at the Open University, describes the situation as “nothing less than a state of emergency” [3]. He argues that technology has evolved into a “crowbar in a cynical international power game,” warning that Dutch sovereignty and the democratic constitutional state are in significant danger if the nation relies on infrastructure controlled by foreign powers [1][3]. This anxiety is heightened by the geopolitical climate; in December 2025, US President Donald Trump presented a security strategy explicitly described as anti-European, further complicating the trust required for such cross-border technological dependencies [1][3].
The Black Box of Regulatory Assessment
While Solvinity and Kyndryl have reported the planned acquisition to the BTI, the regulatory process remains opaque [1]. The Wet Vifo, enacted in 2023, mandates security screenings for investments in critical infrastructure and sensitive technology, yet it is currently unclear if a full assessment will take place or if the results will ever be made public [1][3]. The expert coalition argues that for a service as fundamental as DigiD, this lack of transparency is unacceptable, stating they are currently “completely in the dark” regarding the protection of national security interests [2][3]. They have set a deadline for the coming Tuesday for the government to provide clarity, threatening legal action if the opacity continues [6].
The Illusion of Technical Sovereignty?
The debate over Solvinity occurs alongside broader industry attempts to reconcile US ownership with European sovereignty requirements. Amazon Web Services (AWS) is currently investing nearly €8 billion in a “European Sovereign Cloud,” a project in which Kyndryl is also a partner [7]. Amazon argues that technical measures, such as allowing customers to hold their own encryption keys and ensuring metadata stays within the EU, can guarantee sovereignty even under an American parent company [7]. However, the critics of the Solvinity deal contend that operational autonomy and encryption do not negate the legal leverage the US government holds over American corporations [4][7]. As the digital economy increasingly relies on scalable SaaS and cloud infrastructure, the Dutch government faces a critical decision: whether to prioritise the efficiency of global tech partnerships or the strict assurance of national data sovereignty.