The company that takes over DigiD after the current contract with tech firm Solvinity ends in 2028 will have to be European, ministers have decided. The cabinet announced on Thursday that national defence rules will govern the next contract to keep sensitive data out of reach of foreign governments like the US.
Junior home affairs minister Eric van der Burg told MPs that DigiD’s next hosting platform will run under the Defence and Security Procurement Act (ADV), which gives the government more room to screen bidders for national-security risks.
DigiD is the login that more than 16.5 million people in the Netherlands use to file tax returns, arrange health insurance, draw a pension and deal with their council.
Turning a veto into a rule
Last month, the cabinet blocked the sale of Solvinity to US group Kyndryl, a former IBM subsidiary, on the advice of the BTI, the agency that vets foreign investments for security risks.
Without that veto, MPs and campaigners warned, the data behind DigiD would have fallen within reach of the US Cloud Act, which can compel American-owned firms to hand information to Washington, even when the data is held in Europe, regardless of whether European governments agree.
Routing the next contract through the ADV lets the state put security first on any future deal.
Van der Burg was careful not to cast the change as anti-American. “It is not about whether a company is American or not,” he said, but about whether the country where a firm is based could demand its data.
Parliamentary pressure
The move follows months of pressure from MPs, who in April urged the cabinet not to renew the Solvinity contract at all if the takeover went through.
Progressief Nederland MP Barbara Kathmann warned then that a US owner could “turn off our digital government with one flick of the switch”.
Ministers had already extended the contract to 2028 to keep the service running while the dispute played out. Van der Burg said he would update parliament again once the new contract is awarded.
