DigiD takeover could give US power to access citizens’ personal data, shut down system

A senior Dutch privacy official has warned that a planned U.S. takeover of a key government IT provider could expose sensitive personal data to millions of residents. He also said the deal could allow American authorities to disrupt critical digital services, de Volkskrant reports.

Pieter van Oordt, chief privacy officer at Logius, said both the security of national data and the availability of the country’s main digital identity system, DigiD, are at risk if the acquisition proceeds. His warning follows an internal security analysis and coincides with his decision to challenge the government in court, as he is now preparing legal action against the Dutch state.

The concerns center on the proposed acquisition of Dutch IT company Solvinity, which manages DigiD, by U.S.-based Kyndryl. The deal is awaiting approval from Economic Affairs Minister Heleen Herbert. “I cannot put it more simply: the U.S. can switch off DigiD for an extended period and issue secret information requests,” van Oordt said.

According to van Oordt, the takeover would place DigiD and MijnOverheid under U.S. jurisdiction, exposing “detailed personal data of all Dutch citizens” to American authorities. U.S. agencies could request data under laws such as the Cloud Act or the Foreign Intelligence Surveillance Act and potentially block access to the provider through sanctions legislation.

Through MijnOverheid, around 100 million letters containing sensitive information are sent annually, including details on family composition, names, ages, addresses, vehicle registrations, benefits, tax debts, and student financing.

An internal Logius security assessment, shared with the Ministry of the Interior on Nov. 24 but not with parliament, warned explicitly of these risks. It concluded that, given the current system architecture, “the platform cannot be technically sealed in such a way that the supplier would no longer be able to access data/personal information or influence availability.”

The report also dismissed mitigation efforts as insufficient, stating: “Mitigating measures that Logius could take are not watertight and will require enormous effort for many systems.” Van Oordt reiterated that point: “Additional measures are in all cases insufficient to prevent outages of DigiD and unlawful use.”

DigiD is widely considered the backbone of the Netherlands’ digital infrastructure. About 17 million users rely on it to access government services, hospitals, and pension funds, with roughly 2 million login sessions daily.

In March, a Radar Panel survey of more than 28,000 respondents found that 87 percent of DigiD users said they would stop using the system if it came under U.S. ownership, while 75 percent of those who had tried to handle government services without DigiD said they were not successful in every case.

Van Oordt said he repeatedly raised concerns internally within the Ministry of the Interior but failed to secure action. “Escalations to the highest civil-service level have not provided a solution. I was not granted access to the state secretary of the interior," he told the newspaper. He said going public was his last option to inform politicians “via society” and halt the takeover in favor of an alternative plan.

A spokesperson for the Ministry of the Interior said there is currently “no news” about the process. The ministry said it looked closely at van Oordt’s legal options, including input from the state advocate, and decided that his proposed solution is not viable.

The Ministry of Economic Affairs declined to comment on the status of the takeover, saying there is “nothing to report at this time.”

The acquisition is being reviewed under three tracks outlined in a February letter to Parliament, including assessments by the Authority for Consumers and Markets and the Bureau for Investment Screening. The competition authority has already approved the deal. Talks are reportedly underway among government officials, Solvinity, and Kyndryl on additional data security safeguards.

However, a senior government source reportedly told de Volkskrant that legal tools to block such takeovers are limited due to the principle of an open market. “From that perspective, the legal means to stop it are limited,” the source said.

The source also noted a broader geopolitical shift: “There is still a belief within part of the government that the U.S. is an important ally. Alliances are currently changing rapidly.”

Concerns about the takeover have spread beyond the Ministry of the Interior. Solvinity also manages IT systems for the National Police, the Public Prosecution Service, the judiciary, and the municipality of Amsterdam.