Key Points:
- State Secretary Willemijn Aerdts officially blocked U.S. firm Kyndryl from acquiring Solvinity, the operator behind the Dutch digital ID system.
- The regulatory agency BTI concluded that the proposed takeover by the American company posed an unacceptable risk to the public interest.
- Critics warned that placing Solvinity under U.S. ownership would expose the private data of 18 million Dutch citizens to the U.S. CLOUD Act.
- The decision follows the high-profile “Microsoft leak,” in which U.S. authorities compelled the disclosure of Dutch civil service data without notice.
The Dutch government has officially blocked a planned U.S. takeover of Solvinity, the local IT and cloud provider behind the country’s national digital identity system, DigiD. On Tuesday, May 26, 2026, Dutch State Secretary of Economic Affairs Willemijn Aerdts announced that she had vetoed the acquisition by American IT services giant Kyndryl. Citing the urgent need to protect the public interest, Aerdts stepped in to halt the transaction just as the two parties prepared to finalize the deal, marking a major milestone in Europe’s growing push for digital sovereignty.
The core of the government’s concern lies in the sensitive nature of the data that Solvinity manages. The company operates the hosting platform for DigiD, the secure digital gateway that 18 million Dutch citizens use to access crucial government, tax, healthcare, and pension services. If Kyndryl—a massive IT services company spun off from IBM—had successfully acquired Solvinity, the critical infrastructure hosting these national digital identities would have fallen under American ownership.
This transition of ownership would have exposed the private data of millions of Dutch citizens to the extraterritorial reach of the United States. Under the controversial U.S. CLOUD Act, American law enforcement and federal agencies have the legal authority to compel U.S.-owned companies to hand over or disclose stored data, regardless of whether the physical servers are located in Europe. Legal experts and members of the Dutch Parliament warned that allowing Kyndryl to buy Solvinity would place the private, confidential records of Dutch citizens directly within the scope of U.S. surveillance laws.
The decision to block the sale follows a major public and political outcry inside the Netherlands. In February 2026, Dutch media reported that Microsoft had handed over the private email data of Dutch civil servants to U.S. authorities under the CLOUD Act without notifying the Dutch government. This revelation lit a fire under European privacy commissioners and lawmakers. Many argued that allowing another critical piece of public infrastructure to fall into American hands would represent an unacceptable breach of national sovereignty, especially under the current administration of U.S. President Donald Trump.
Fearing these security implications, Aerdts instructed the Investment Screening Bureau (BTI) to conduct an exhaustive security review of the merger. The BTI, which monitors mergers and acquisitions for compliance with the Insufficient Controls of Telecommunications Act (WOZT), concluded that the intended acquisition posed an unacceptable risk to the public interest. Following this recommendation, the State Secretary issued her veto under the country-neutral WOZT framework, completely prohibiting the transaction.
To justify the veto, the Dutch cabinet emphasized that the screening process was entirely objective, risk-based, and country-neutral. Aerdts clarified that the decision did not target the United States specifically, maintaining that the Netherlands continues to place great value on the presence of foreign technology companies—especially American ones—and their contributions to the Dutch economy and digital infrastructure. However, she emphasized that the government has a non-negotiable duty to protect the public interest when national security and citizen privacy are at stake.
The blocked acquisition represents a massive setback for Kyndryl and Solvinity’s majority owner, the British private equity firm Vitruvian Partners. The two firms had agreed on the terms of the takeover last November, hoping to combine Solvinity’s regional public-sector expertise with Kyndryl’s massive global scaling power. Kyndryl, which recently saw its market share decline by 1.5% in other regional markets, was looking to use the acquisition to expand its footprint in the European public sector.
This intervention fits a growing, broader trend of European governments taking a highly protective stance toward their national digital assets. Over the past few years, countries like France and Germany have steadily tightened their foreign investment screening rules to prevent critical technology, cybersecurity, and cloud infrastructure firms from falling into foreign hands. By blocking the Kyndryl-Solvinity deal, the Netherlands has sent a clear message to global markets that European digital identity and public-sector data are not commodities that companies can buy and sell.
As the Dutch Ministry of Economic Affairs prepares to hold discussions with Solvinity’s board in the coming weeks, the focus will shift to finding alternative, European-based funding sources. While the decision prevents a vital piece of the country’s digital infrastructure from falling under foreign jurisdiction, it also highlights the challenges European tech firms face in scaling without American capital. Balancing the need for foreign investment with strict digital sovereignty remains the defining technology-policy challenge for Europe’s next generation.
