Parliament again tells Dutch gov't to prevent DigiD from ending up in American hands

A majority in the Tweede Kamer, the lower house of the Dutch parliament, has again instructed the Dutch government to prevent DigiD data from ending up in American hands. This could happen through the potential acquisition of Solvinity, the company that manages DigiD’s servers, by the American company Kyndryl.

Millions of Netherlands residents use DigiD every day to access their data at the Tax Authority, their municipality, and their health insurer, among other things. The government agency Logius built and manages DigiD, but its servers are managed by Solvinity. And Solvinity is about to be acquired by an American IT company, Kyndryl.

According to experts, this poses two specific risks. First, the U.S. government can demand access to data from American companies, including data stored outside the U.S. Secondly, the U.S. could pull the plug on DigiD, leaving Dutch people unable to access government services.

A majority in parliament supported a motion by GroenLinks-PvdA parliamentarian Barbara Kathmann to prevent DigiD data from ending up in U.S. control. “We simply do not want this to end up in American hands. Period,” she said to RTL Nieuws.

Parliament wants the responsible Minister, currently the caretaker Minister of Home Affairs, to intervene. If Kyndryl takes over Solvinity, DigiD servers should move to another Dutch, or at least European, company.

“When the contracts expire, we’ll bring back those assignments and award them to a Dutch party,” Karthmann said. She hopes that this prospect will make the acquisition less attractive for Kyndryl, causing the deal to fall through.

Last month, a group of tech experts told the Volkskrant that the Dutch government has two options to block this acquisition. The Undesirable Control of Telecommunications Parties Act lets the government stop an acquisition if it poses a threat to public interest. For example, if the new owner is under the influence of a country that may deliberately want to cause service outages. The Foreign Acquisitions Review Act (Vifo) allows the government to stop the purchase if the new owner poses a risk to national security.

U.S. president Donald Trump already proved he would cut services to people who upset him last year, when he banned American companies from providing services to the chief prosecutor of the International Criminal Court in The Hague. The United States also poses a risk to national security because DigiD is such a vital service, they said.