Why the Netherlands Is Worried About an American Tech Company Buying a Key Government Service

Kyndryl, a US technology services company that was spun out from IBM, wants to buy Solvinity, a Dutch company that hosts essential government systems. Last Friday, Dutch lawmakers raised alarms in Parliament about what happens when a foreign company takes control of infrastructure that Dutch citizens rely on every day.

Solvinity runs the servers and systems behind DigiD—the digital ID platform that Dutch residents use to access government services online. The company also hosts MijnOverheid, which is basically the government's digital mailbox, and systems for the Central Judicial Collection Agency, which handles fines and penalties. Although Solvinity was originally founded in the Netherlands, a British firm now owns most of it.

The proposal has sparked real public concern. A survey of 28,000 Dutch residents found that 87% said they would stop using DigiD if the US takeover went ahead, and 96% expressed worry about Kyndryl acquiring Solvinity.

Why Parliament Is Concerned

Dutch lawmakers worry that if Kyndryl takes over, sensitive government data could end up under the control of a foreign company—and by extension, foreign governments. The specific fear is tied to recent US politics: what if the Trump administration's policies change, and suddenly the Netherlands loses access to its own digital systems because of US sanctions or policy decisions?

Think of it this way: if a US company controls the servers that host your government ID system, then US law and US policy decisions can affect whether you can access government services. The Netherlands would lose direct control over critical infrastructure. This concern extends to the possibility that US law—like the CLOUD Act, which gives the US government broad powers to access data—could force Solvinity to hand over Dutch citizen information to American authorities.

The timing reflects a broader worry across Europe. Earlier this year, Dutch companies published a position paper warning that when governments rely on foreign cloud services for critical functions, those services can become tools of political pressure. This acquisition fits that exact scenario.

What These Systems Actually Do

DigiD is the main login system for Dutch government services—it is as fundamental to citizens' interaction with government as a driver's license or passport, except digital. MijnOverheid is the central hub where government communicates with citizens: tax letters, official documents, everything goes through there. The Central Judicial Collection Agency's systems process fines and collect penalties across the Dutch justice system.

When security experts talk about "critical national infrastructure," they mean systems whose failure would seriously disrupt how government works and how citizens access essential services. These three systems fall squarely into that category. Right now, they run on Solvinity's servers and are managed by Solvinity's technical teams. If Kyndryl takes over, a US company would have operational control of all of it.

The Pattern Here

Over thirty years of covering technology deals, I have watched this same collision unfold repeatedly: a straightforward business acquisition that suddenly becomes a national security issue. We saw it during debates over Huawei selling telecom equipment to European countries, during the TikTok acquisition discussions, and in various semiconductor industry transactions. What looks like a routine corporate merger turns into a flashpoint about technological dependency and who controls critical systems. The ingredients are always the same—a foreign company trying to buy into infrastructure that a nation depends on—and the stakes are always about losing control.

The Technical Reality

When a cloud provider—whether Dutch or American—manages government systems, it has significant power over how those systems operate. It controls security settings, backup procedures, disaster recovery plans, and where data physically sits. When that provider is subject to US law and jurisdiction, the Dutch government loses direct oversight of how its own critical infrastructure is managed.

For Kyndryl, acquiring Solvinity would be a strategic move. The company provides IT infrastructure services to large enterprise customers, and government contracts tend to be stable, long-term revenue sources. Kyndryl would gain established relationships with Dutch government agencies and a proven track record managing secure hosting.

How the Government Might Respond

Dutch lawmakers signaling alarm suggests that regulatory action could follow. European governments have grown more careful about letting foreign companies buy firms that handle sensitive data or critical infrastructure, especially after the EU's push for what it calls "digital sovereignty"—basically, the idea that Europe should not depend on non-European technology companies for essential services.

The Netherlands has legal tools to block deals it considers threats to national security. The Investment Screening Act gives the government the power to review and reject foreign acquisitions of critical infrastructure. The public response from Parliament suggests this law could be invoked.

The survey showing that 87% of Dutch residents would stop using DigiD is worth noting, though with some caution. Public opinion surveys on technical infrastructure questions can shift significantly depending on how the questions are asked and what information people have at the time. That said, the fact that such high numbers of citizens are paying attention to digital sovereignty issues—and would actively stop using a government service over it—puts real political pressure on lawmakers to act.

The Bigger Picture for Europe

This acquisition attempt arrives as European governments are trying to reduce their dependency on American (and Chinese) technology companies for essential services. The EU has passed new rules—the Digital Services Act and Digital Markets Act—aimed at keeping control over digital infrastructure. Various countries are also strengthening rules around cybersecurity and critical infrastructure protection.

The Netherlands now faces a choice: allow Kyndryl to buy Solvinity, or block it on national security grounds. How the Dutch government decides will likely influence what other European countries do when they face similar acquisitions. If the Netherlands blocks the deal or demands significant conditions, it could set a precedent for more restrictive policies across Europe toward foreign acquisitions of infrastructure providers.

In the longer term, if more European governments decide to block foreign takeovers of critical infrastructure, we may see a shift toward building and maintaining government cloud services within Europe itself. That would require substantial public investment and years of planning, but it would reduce dependency on global technology companies whose allegiances and legal obligations lie elsewhere.