Dutch Parliament Demands Action to Block American Access to DigiD Data

A clear majority in the Dutch parliament has issued a directive to both the current caretaker government and the incoming cabinet, demanding they exhaust all available measures to ensure that data from the national DigiD system does not fall under the jurisdiction of the United States government. The urgency stems from the impending acquisition of the Dutch cloud infrastructure company Solvinity by the American firm Kyndryl.

Solvinity operates the technical backbone that facilitates data transfers for DigiD, the mandatory digital identification used by all residents to interact with entities like health insurers, pension funds, municipalities, and the Tax Authority. The parliamentary concern is not merely theoretical; it is rooted in the legal framework of the United States, where the government possesses broad authority to compel American companies to surrender data. This creates a direct pathway for U.S. intelligence or law enforcement agencies to potentially access sensitive Dutch citizen information.

During a technical briefing in the Tweede Kamer on Tuesday, MPs heard from experts who did little to calm these fears. The discussion highlighted the complex intersection of corporate law, international data sovereignty, and national security. VVD parliamentarian Silvio Erkens expressed grave concern that the acquisition could "enable the U.S. government to access data" and potentially be used as a tool for coercion. GroenLinks-PvdA MP Barbara Kathmann articulated a more visceral risk, worrying that the situation could evolve to a point where "Trump can shut down our digital government with the single push of a button," underscoring the dependency on a foreign-controlled entity for critical national infrastructure.

The parliamentary response is not a formal legal block, as the Tweede Kamer lacks the power to directly prevent a corporate merger. Instead, it is a political directive to the executive branch. MP Kathmann outlined several potential avenues for the government to intervene. One approach is diplomatic and commercial pressure, persuading Solvinity to reconsider the deal. Another is a strategic shift: the government IT service, Logius, could initiate a transition to a different service provider for DigiD, effectively severing the link to Solvinity. A more aggressive, and legally complex, option would be for the state to attempt to acquire a "golden share" in Solvinity, a special share that would grant the Dutch government veto power over critical decisions, including the sale of the company or the handling of sensitive data.

MP Erkens presented a starker ultimatum: the deal must be blocked unless there are unassailable legal guarantees that Dutch data will remain inaccessible from U.S. soil. Failing that, the government must ensure Solvinity is completely removed from the DigiD service chain post-acquisition.

This debate is occurring against a backdrop of broader national security recalibration. Digital security is a key topic in the ongoing coalition negotiations to form a new government. Rob Jetten, the leader of D66 and the designated future Prime Minister, has already signaled that the new cabinet will feature a "Minister with very specific responsibility for digital security." While the exact scope of this minister's authority and budget remains to be defined, Jetten emphasized that the role will come with a "clear mandate," suggesting a more centralized and empowered approach to managing the country's digital resilience.

The situation with Solvinity and Kyndryl serves as a concrete, high-stakes test case for this new ministerial focus. It forces the Dutch government to confront a fundamental question of the modern state: how to maintain sovereignty over citizen data in an era of globalized cloud infrastructure and corporate consolidation, where the lines between commercial enterprise and state power are increasingly blurred. The outcome will likely set a precedent for how other nations with similar digital identity systems navigate the tension between technological efficiency and data security in a geopolitically charged environment.