Europe’s digital sovereignty push meets US security law in Dutch Kyndryl decision

The Netherlands’ decision to block Kyndryl’s acquisition of cloud provider Solvinity is becoming a test case for Europe’s expanding definition of national security.

Solvinity manages infrastructure supporting DigiD, the national digital authentication system Dutch residents use to access tax, healthcare, pension and municipal services, as well as MijnOverheid, the government portal for official notices and personal records.

Because Solvinity operates infrastructure underpinning essential government services, Dutch officials viewed the acquisition as a national security issue rather than simply a corporate transaction.

Kyndryl announced in November 2025 that it had agreed to buy Solvinity, describing the Amsterdam company as a provider of secure managed cloud services. The acquisition would have expanded Kyndryl’s ability to serve customers with sensitive workloads and data sovereignty requirements.

Solvinity does not own DigiD, MijnOverheid or government data, but it operates the underlying infrastructure supporting those services, giving it a critical role in systems used by more than 16 million people.

Risk to the public interest

After reviewing the acquisition under Dutch investment screening rules, the government concluded the transaction posed an unacceptable risk to the public interest and blocked the deal.

In a letter to Parliament, State Secretary Willemijn Aerdts described the process as country-neutral, risk-based, and proportionate. She emphasized that foreign technology companies, including American providers, remained important to the Dutch economy.

The detailed security assessment was not made public.

Kyndryl said it was extremely disappointed and argued that political concerns had overshadowed the benefits the acquisition could have provided to Solvinity’s customers and Dutch citizens.

The prohibition remains under administrative challenge after the Rotterdam District Court refused to suspend the order in July, finding the government could reasonably view the acquisition as a public interest risk while continuing to assess whether less restrictive safeguards might address its concerns. A final administrative decision is expected by the end of September.

The court proceedings also clarified the issue at the center of the government’s decision. Dutch officials were concerned that American authorities could use U.S. law to seek sensitive information available to Solvinity through Kyndryl’s U.S. parent company.

Foreign jurisdiction

That concern focused heavily on the CLOUD Act, a 2018 law that clarified that providers subject to American jurisdiction can be required through valid legal process to produce data within their possession, custody, or control, even when the information is stored abroad.

The law does not give U.S. authorities unrestricted access to foreign servers or remove the need for legal authorization. Washington views it as an essential law enforcement tool. European policymakers increasingly see its extraterritorial reach as a sovereignty concern.

From that perspective, keeping data in Amsterdam or Frankfurt does not provide complete control if the company operating the infrastructure remains subject to a foreign court.

The issue is not only whether American authorities are likely to seek particular information, but whether another government possesses a legal pathway to the provider and whether European officials can guarantee that the system remains under their control during a legal or political conflict.

The Dutch government acknowledged the issue before blocking the acquisition, telling Parliament that U.S. law could theoretically allow American authorities to obtain information held by an American company even when stored by a subsidiary on servers outside the United States.

There is no public evidence that U.S. authorities sought DigiD information, that Kyndryl intended to provide access, or that either company mishandled Dutch government data. The decision instead reflects concern over the potential consequences of future corporate control rather than any known breach.

A broader policy shift

The broader policy direction became clearer in June, when the Dutch government announced that the next contract for the infrastructure supporting DigiD would be awarded under the Defence and Security Procurement Act.

Officials said the law provides greater latitude to address national security risks than an ordinary European procurement.

The current Solvinity contract can continue until August 2028 while the government prepares a replacement and avoids disruption to essential digital services.

The government therefore reached two conclusions that appear contradictory only at first. Solvinity remained necessary in the short term, but transferring it to American ownership created a risk serious enough to prohibit.

The Center for Strategic and International Studies has described the case as an early sign of a wider change in investment screening.

Governments are increasingly treating control over data architecture and digital services much as they have traditionally treated ownership of ports, telecommunications networks and defense suppliers.

Wallet infrastructure

The precedent could be especially important as EU member states prepare to introduce European Digital Identity Wallets.

EUDI wallets are intended to let people authenticate themselves and present verified identity attributes across borders while limiting the amount of personal information disclosed.

DigiD and the European wallet are separate systems, and the Dutch decision does not create an EU-wide ban on American providers. It does, however, offer a model for how governments may evaluate the infrastructure surrounding wallet services.

Credentials may be held on a user’s device, but the wider system will still depend on national identity registers, credential issuers, validation services, security monitoring, and account recovery.

A question of control

A provider could therefore occupy a strategically important position without holding a centralized biometric database. The relevant question is who controls the cloud environment, signing systems, administrative accounts, and security logs on which the service depends.

Some deployments also rely on facial comparison, document authentication and liveness detection to establish or restore identities, extending sovereignty questions beyond cloud infrastructure alone.

The European Commission’s proposed Cloud and AI Development Act would move in the same direction. The proposal would establish four sovereignty assurance levels for cloud services used by public authorities, with higher levels examining ownership, operational control, personnel, and exposure to foreign interference.

The proposal is not law and does not impose a blanket exclusion on U.S. companies. It nevertheless shows why European data centers alone may no longer satisfy public buyers when the provider remains legally or operationally dependent on a foreign parent.

For American cloud companies, the European government market could become increasingly divided by sensitivity. Ordinary workloads may remain broadly open, while identity, justice, defense, and other critical systems are subjected to stricter control requirements.

Identity, biometric and cybersecurity vendors could face similar scrutiny over where data is processed, who controls administrative access and whether privileged operational information remains subject to foreign jurisdiction.

A new security model

Transatlantic cooperation is unlikely to end. The U.S. and EU both recognize that criminal investigations require faster access to electronic evidence across borders.

The EU has adopted its own e-evidence framework, and the two sides resumed negotiations in 2023 over a broader agreement, although no completed accord has been publicly announced.

The deeper conflict is over control.

Washington asks how democratic governments can obtain evidence quickly enough to investigate terrorism and serious crime, and Europe increasingly asks whether a foreign state should possess a legal route into the companies operating its most sensitive public systems.

Solvinity shows how those questions can collide without an allegation of misconduct. It also suggests that compliance with European privacy and cybersecurity rules may no longer be enough for U.S. companies competing for the most sensitive government contracts.

Increasingly, the deciding question may not be where data is stored, but who ultimately controls the infrastructure when the laws and interests of close allies diverge.

Article Topics

biometrics  |  DigiD  |  digital ID infrastructure  |  digital sovereignty  |  digital wallets  |  Kyndryl  |  national security  |  Netherlands  |  Solvinity  |  U.S. Government