Citing the risks to its citizens’ data, the Dutch government has blocked the €100 million takeover of Solvinity by an American company, Kyndryl, ensuring that the infrastructure behind the national digital identification service DigiD will stay in European hands for now.
The decision on May 25, 2026, was the first time the Bureau for Investment Screening had blocked an American takeover on grounds of public interest, and it fits into a broader European movement toward protecting digital sovereignty: increasingly, countries are taking concrete steps to keep crucial digital infrastructure under their own control.
Why the DigiD takeover sparked so much resistance
Solvinity manages the cloud infrastructure on which DigiD runs — the system that gives Dutch citizens access to tax records, medical files, and pension information. When Kyndryl announced the takeover of Solvinity in November 2025, broad opposition emerged immediately.
The primary concern was the American CLOUD Act. This law requires American tech companies to provide data to the US government, even when that data is physically stored in Europe. The takeover would have meant that personal data of millions of Dutch citizens would fall under American jurisdiction, outside the protection of the European GDPR.
This dependence is no theoretical risk. Our own research shows that 81% of Dutch publicly traded companies depend on American tech services. In strategically crucial sectors such as semiconductors (including microchips), this rises to 83%.
The rejection was the result of months of action by citizens, journalists, and privacy activists. State Secretary Willemijn Aerdts adopted the advice of the Bureau for Investment Screening: the takeover posed “a risk to the public interest.” A broad parliamentary majority supported the decision.
Digital sovereignty: from policy to action
In December 2025, the Netherlands presented a new vision on digital sovereignty, emphasizing that crucial infrastructure must fall under Dutch or European legislation. The country is actively investing in its own cloud alternatives such as STACKIT and the KPN-Thales sovereign cloud.
This development fits into a broader European pattern toward digital independence, with countries like France replacing American tools and the EU bringing chip production back to Europe through the CHIPS Act. Earlier this month, the EU Parliament ditched Google in favor of a European alternative search engine, Qwant.
What this means for your privacy
Control over digital infrastructure is no longer a technical detail — it’s a matter of national security and civil rights. When medical data, financial information, and personal communication are all digital, whoever controls that infrastructure also determines who has access to that data.
This applies not only to government systems like DigiD, but also to your everyday internet use. Your internet traffic passes through the servers of your internet provider and the websites you visit, often under American or non-European jurisdiction. With a premium VPN based in Europe(new window), such as Proton VPN, you can encrypt your internet traffic and route it through servers in the Netherlands(new window) or other European countries, keeping your data under European privacy legislation.
The Netherlands has shown with the rejection of the DigiD takeover that digital sovereignty is achievable. Now it’s up to citizens to also protect their personal data.
