Dutch MPs remain skeptical over U.S. company's DigiD takeover despite safeguards

Tech company Kyndryl has failed to allay Dutch MPs worries over its takeover of the company behind DigiD. During a session in the Tweede Kamer, the lower house of Dutch parliament, executives from Kyndryl Netherlands outlined numerous safeguards intended to ensure that the U.S. government cannot disable DigiD following the acquisition.

DigiD is the Netherlands’ central digital identity system, used by millions of citizens to log in securely for tax services, healthcare portals, pension systems, municipal services, and more. The Kyndryl division, seeking to acquire Solvinity, is based in the Netherlands. Yet, as a subsidiary of the U.S. company Kyndryl, it could be required by the American government to provide data or suspend services.

While Solvinity does not own DigiD, that authority lies with Logius, a government agency under the Ministry of the Interior. Solvinity operates the digital platform on which DigiD runs, including servers and security infrastructure in a Dutch government data center.

Even with the measures in place, MPs remained unconvinced. Barbara Kathmann (GroenLinks-PvdA) and Amin el Boujdaini (D66) said at the conclusion of the meeting that additional safeguards are necessary. Kathmann suggested the idea of a golden share to guarantee that the government services managed by Solvinity, including DigiD, remain under Dutch control.

The management team at Kyndryl, made up of three Dutch and one Irish executive, answered MPs’ questions by repeating the safeguards already established. They explained that any government requests to access data are passed on to clients, and that technical, organizational, and legal measures are in place to block foreign access to the data.

Kyndryl stressed several times that trust is crucial. “Safeguarding data is at the heart of what we do. If we violate that trust, we put both our reputation and our business at risk,” said Conal Hickey, the company’s security expert.

The Bureau Toetsing Investeringen (BTI), the Dutch government’s investment screening body, is currently conducting an independent national security assessment of the proposed takeover. Its role is to determine whether the acquisition poses risks to national security, particularly given Solvinity’s role in hosting the digital infrastructure for crucial services. The agency’s review could take several months.