Dutch Court Weighs DigiD Takeover Block

Every time a Dutch citizen files taxes online, checks a benefit, or logs into a public service, they pass through DigiD, the Netherlands' national authentication system. It is the sort of digital infrastructure that works best when nobody notices it. The Solvinity case shows why citizens probably should.

Solvinity, a private company, runs the platform on which DigiD operates (AG Connect). When Kyndryl, the US-headquartered IT group, tried to buy Solvinity, the Dutch government blocked the deal on national-security grounds. In June, Solvinity challenged that decision before a Rotterdam court. Part of the hearing was held behind closed doors (Tweakers).

For Maltese readers, the issue is not abstract. We already live with the trade-off between outsourcing state capacity and keeping enough control inside government to protect the public interest. "Digital sovereignty" can sound like a Brussels slogan until it becomes a court case about who may own the companies that keep the state online.

The control room behind the grid

Digital government works rather like a public power grid. The state sets the rules and puts its name on the service. But a private contractor may hold the operating knowledge: maintenance procedures, encryption keys, administrative access, and the experience needed to keep the system running under pressure (policyreview.info). For part of the Dutch digital state, Solvinity occupied that position.

On 26 May 2026, State Secretary Willemijn Aerdts formally blocked the takeover (Logius). The full risk assessment has not been made public. Parliament received confidential information, and the court heard sensitive material in a closed session, away from journalists (Tweede Kamer).

What has emerged publicly is that Dutch MPs worried US ownership could allow Washington to request data or, in the worst case, affect access to services citizens rely on every day (NOS). The US CLOUD Act became central to that debate.

The CLOUD Act is a real legal exposure, but it is often made to carry more than it actually says. US law can require a provider under American jurisdiction to hand over data in its "possession, custody, or control" when served with a lawful order, even if the data is stored in Europe (Cornell LII). That matters.

What the law does not do is give Washington a remote button to browse systems or shut a service down at will. That fear belongs to a wider category: dependency on a supplier, contractual breakdown, loss of administrative access, or the difficulty of replacing a critical provider in a crisis. These are serious risks, but they are not the CLOUD Act. Blurring the two makes a structural problem sound like a conspiracy theory.

The stronger point is simple. "The data stays in Europe" is not enough. Data location is one layer. Control is the deeper one: who can administer the system, push updates, recover from failure, and keep the service alive if the commercial relationship breaks down.

Three countries, three approaches

France has tried to make sovereignty practical rather than rhetorical. A cloud provider seeking sensitive state work must obtain SecNumCloud certification, which requires proof that foreign laws cannot easily reach the service (Alliancy). The slogan becomes a procurement rule: qualify, or do not bid.

Sweden has taken another route. Instead of screening every vendor in the same way, it focuses on state control over the root of identity. The Justice Ministry has proposed a new state-issued ID card with biometrics and built-in electronic identification (Dagens.se). Sweden has also led work on the certification system for the EU's coming digital identity wallet (Digg). Private companies may handle the pipes, but the state keeps the master key.

The Netherlands looks more reactive. Dutch parliamentary documents show broader thinking about sovereign cloud services (1848.nl). But the Solvinity dispute is narrower: one takeover, blocked after a confidential risk assessment, now being defended in court.

Malta should be watching this closely. A small state often depends on private contractors because building every capability in-house is expensive and slow. That is true from health systems to identity services. The question is where efficiency stops and exposure begins.

What the court will actually decide

The EU is not trying to build a separate internet. It is building legal tools that let governments question takeovers, demand cybersecurity safeguards, and make cloud suppliers easier to replace. Foreign-investment screening allows member states to review acquisitions in sensitive sectors (Paul Weiss). NIS2 adds security and supply-chain duties for operators of critical infrastructure (European Commission). The Data Act deals with switching between cloud providers and protection against unlawful foreign data requests (EUR-Lex).

None of these instruments solves the problem alone. Together, they move the debate from "where is the server?" to "who governs the dependency?"

The Rotterdam case will test that shift. If the Dutch government wins, it strengthens the principle that ownership changes in public digital infrastructure can be blocked even when the detailed risk analysis remains classified. If Solvinity wins, the state may have to show that it considered less drastic options: tighter contracts, separation of sensitive operations from the foreign parent, or mandatory exit plans.

The court is being asked how much evidence a government must show when it blocks a takeover to protect a service citizens cannot realistically avoid. For the millions who log into DigiD without thinking, that is the real issue. For Malta, where digital state capacity is often built through a small circle of suppliers and consultants, it is a warning worth taking seriously.