The Dutch Government has decided to block the US takeover of the state digital ID provider over fears of data breaches and risks to the public interest.
State Secretary for Digital Economy Willemijn Aerdts formally prohibited US IT company Kyndryl from acquiring Solvinity Group, the Dutch firm that manages the Picard platform, the digital infrastructure on which DigiD runs.
Solvinity and Kyndryl, a New York-listed IT services firm spun off from IBM in 2021, had announced their intention to proceed with the €100 million acquisition in November 2025.
The Dutch Investment Screening Bureau (BTI) opened an investigation the same month and after six months of assessment, it concluded the deal posed a potential risk to the public interest, prompting Aerdts to act. It is the first acquisition the BTI has ever prohibited since the screening body was set up under the Vifo Act on investment review.
In her letter to the Tweede Kamer, the lower house of the Dutch parliament, she noted she had received “serious indications that completion of the transaction was imminent” — suggesting the prohibition was issued under significant time pressure to prevent the deal from closing.
DigiD is the universal digital identity system used by some 17 million Dutch citizens to file tax returns, apply for benefits and access virtually all government services, from healthcare records to pension files. Solvinity also operates MijnOverheid, the central portal for government correspondence, and Digipoort, a key digital gateway for businesses dealing with public authorities.
Had Kyndryl acquired Solvinity, Dutch and European legal experts warned that US legislation including the CLOUD Act and the Foreign Intelligence Surveillance Act (FISA) could theoretically grant American authorities access to the personal data of millions of Dutch citizens processed on the platform.
A coalition of Dutch journalists, technology experts, scientists and the privacy organisation Privacy First — led by investigative journalist Eric Smit of The Firewall — sued the government to block renewal of its contract with Solvinity precisely over those data risks.
The court dismissed their claims, ruling that taking DigiD offline posed a greater societal risk than the privacy concerns.
Even though there may be privacy risks if Solvinity falls under US legal reach, the immediate operational need to keep critical government systems running safely outweighed those concerns.
The court argued that switching to a new provider would take a minimum of six to eight months due to the platform’s technical complexity, and that non-renewal risked pulling DigiD offline and triggering a societal crisis.
The plaintiffs were also ordered to pay the State’s legal costs of €2,101.
Aerdts was careful to frame the block as country-neutral, stressing that the screening framework “applies equally to all investors regardless of country of origin.”
“The Netherlands greatly values the presence of foreign — explicitly including American — technology companies and their contribution to the Dutch economy and digital infrastructure,” she said in her letter.
She insisted that the Netherlands’ approach was focused on “protecting the public interest” and that the framework “applies equally to all investors, regardless of country of origin.”
Kyndryl may now challenge the prohibition in court.
