Dutch court backs DigiD contract renewal amid U.S. CLOUD Act fears

A Dutch court has ruled that the government may extend its contract with Solvinity, a key infrastructure provider for the Netherlands national digital identity system DigiD, despite the company’s planned acquisition by a U.S. firm. According to the reasoning provided by the Hague’s preliminary relief court, abruptly ending the relationship with Solvinity could threaten continuity of critical digital government services.

The dispute reflects broader European concerns about digital sovereignty, foreign control over critical public-sector infrastructure and the ability of U.S. legal frameworks to reach sensitive government systems operated through multinational technology providers.

The case was brought by three Dutch citizens, who argued that U.S. authorities could gain access to sensitive Dutch user data under the U.S. CLOUD Act if Solvinity were acquired by Kyndryl, a multinational corporation headquartered in New York. DigiD, which is managed by the government IT agency Logius, serves as the authentication backbone for Dutch public services including taxation, healthcare, pensions and municipal administration.

Plaintiffs also argued that foreign ownership could create operational control risks over critical Dutch government platforms including DigiD and MijnOverheid.

​The judge delivered an immediate ruling on May 6th, allowing the Dutch cabinet to renew its agreement with Solvinity before it expires on August 6th, 2026, and avoid the risk of losing access to essential government applications. In its reasoning, published this Thursday, the Hague District Court explains that judicial intervention would be justified only in the case of unlawful conduct.

“Despite the potential risks, it cannot be said that the State is acting unlawfully by renewing the agreement with Solvinity,” the ruling notes.

The case also examined whether the Dutch government would have an alternative to Solvinity. The government stated that a responsible transition would take six to eight months, while the three Dutch plaintiffs argued that the timeline could be shorter. The court ruled that the claimants’ arguments were too vague.

During the hearing, the government explained that it is discussing potential privacy issues with Solvinity/ The Investment Screening Bureau (BTI) is still reviewing Solvinity’s acquisition, with the Dutch Minister of Economic Affairs and Climate Policy retaining the power to block the deal if the probe uncovers a potential threat to public interest.

Solvinity’s acquisition is also facing resistance from Dutch lawmakers, as well as from a coalition of advocates led by Amsterdam-based foundation Privacy First, which has kicked off its own administrative proceedings against the takeover of DigiD in January.

To pacify the Dutch government and the public, Kyndryl introduced Sovereignty Readiness Assessment framework in April aimed at reassuring governments that data and operations could remain locally controlled within EU jurisdictions. Corporate promises, however, cannot override a federal U.S. court order. The U.S. CLOUD Act can compel American companies to provide data access to U.S. authorities.

Similar sovereignty debates are emerging across Europe as governments reassess dependence on foreign-owned cloud, identity and public-sector infrastructure providers.

Article Topics

cloud services  |  DigiD  |  digital ID infrastructure  |  digital sovereignty  |  Kyndryl  |  Netherlands  |  Solvinity