The digital identity of Dutch citizens will not be hosted on servers under US jurisdiction for the time being. The government has blocked Kyndryl’s acquisition of Solvinity.
Kyndryl is not permitted to acquire Solvinity, according to a decision by the Dutch Ministry of Economic Affairs. Solvinity is a Dutch IT services company that hosts DigiD. Through the acquisition, the Dutch Digital Identity of citizens would de facto be hosted on servers managed by Kyndryl. The government argues that this poses a potential risk to the public interest.
Sovereignty
The proposed acquisition strikes at the heart of the sovereignty issue. DigiD is currently hosted by a Dutch provider, but this independence would vanish with the acquisition by the American company Kyndryl. Kyndryl is subject to US legislation, including the Cloud Act. This implies that the company could, in theory, be compelled to hand over information from Solvinity servers—including DigiD data—to the US.
American tech giants point out that the danger is purely theoretical and that they have never received such requests to date. However, a theoretical risk still undermines the sovereignty of DigiD.
Specifically, the Bureau for Investment Screening (BTI) is invoking the Telecommunications (Unwanted Control) Act. This act is designed to prevent entities with (conflicting) geopolitical interests from playing too large a role in telecommunications infrastructure and services. The BTI reasons that DigiD falls under this scope and advised the ministry to ban the acquisition. That advice was followed.
Notably, Solvinity is not currently in exclusively Dutch hands. The provider is owned by investment firm Vitruvian Partners, headquartered in London. The competent authorities have now determined that an American parent company poses a greater risk than a British one.
The Dutch government is increasingly showing its teeth when it comes to foreign interference in technological matters. This is not always successful, as seen with the Nexperia saga.