Netherlands Blocks US Takeover of Digital ID Firm on Security Fears
The Dutch government blocked US firm Kyndryl's €100 million acquisition of Solvinity Group, which operates critical digital identity infrastructure for 17 million citizens, citing national security concerns.
Willemijn Aerdts, State Secretary for Digital Economy, issued an official prohibition preventing US-based IT firm Kyndryl from completing its planned €100 million takeover of Solvinity Group, according to Brussels Signal. The decision marks the first time the Netherlands has ever blocked a foreign acquisition on national interest grounds since establishing its investment screening authority.
Solvinity operates the Picard platform, the critical digital backbone that powers DigiD, the universal login system used by approximately 17 million Dutch citizens to access government services ranging from tax filings and healthcare records to pension information and benefit applications. The company also runs MijnOverheid, the central government correspondence portal, and Digipoort, a vital digital gateway for businesses interacting with Dutch public authorities.
Kyndryl, a New York-listed IT services company spun off from IBM in 2021, announced its intention to acquire Solvinity in November 2025. The Dutch Investment Screening Bureau (BTI) launched an investigation immediately and concluded after six months that the transaction posed unacceptable risks to the public interest.
American Surveillance Laws at Center of Concerns
Legal experts in the Netherlands and across Europe raised alarm bells that the acquisition would subject Dutch citizen data to American extraterritorial legislation, particularly the CLOUD Act and the Foreign Intelligence Surveillance Act (FISA). Under these statutes, US authorities could theoretically compel Kyndryl to provide access to the personal information of millions of Dutch citizens processed through the platform.
A coalition led by investigative journalist Eric Smit of The Firewall, including technology experts, scientists, and the privacy advocacy group Privacy First, had already filed suit against the Dutch government seeking to block contract renewal with Solvinity over precisely these data sovereignty concerns, as Brussels Signal reports.
A Dutch court dismissed their legal challenge, ruling that the immediate operational necessity of keeping critical government systems online outweighed privacy risks. The court determined that transitioning to a new provider would require a minimum of six to eight months due to technical complexity, and that any disruption to DigiD could trigger a nationwide crisis affecting access to essential government services. The plaintiffs were ordered to cover the State’s legal costs of €2,101.
First Prohibition Under Investment Screening Law
Aerdts emphasized in her formal notification to the Tweede Kamer, the lower house of the Dutch parliament, that she had received serious indications the transaction was on the verge of completion, suggesting the prohibition was issued under significant time pressure to prevent the deal from closing before regulatory review concluded.
The State Secretary was careful to frame the decision as country-neutral, stating that the screening framework applies equally to all foreign investors regardless of origin. She stressed that the Netherlands values American technology companies and their contributions to the Dutch economy and digital infrastructure, but that protecting the public interest remained paramount.
Kyndryl now has the option to challenge the prohibition through Dutch courts.
With information from Brussels Signal
