Dutch government extends DigiD contract amid data sovereignty fears

2026-04-26 politiek

Den Haag, zondag, 26 april 2026.
The Dutch government has extended its contract with Solvinity, the operator of the country’s central digital identity system DigiD, despite strong opposition in parliament. This move comes as the American IT company Kyndryl moves closer to acquiring Solvinity, raising alarms about the control of sensitive citizen data. Internal warnings from Logius’ chief privacy officer highlight serious risks to national digital sovereignty. He argues that U.S. authorities could gain access to detailed personal records under American law. The decision prioritizes service continuity over immediate change, leaving many questions unanswered about long-term data security.

government overrides parliamentary concern

The Dutch cabinet has formally approved a two-year contract extension with Solvinity for the operation of DigiD, overriding objections from a broad coalition in the Tweede Kamer [nu.nl]. The decision was made by Ministerial Order on March 27, 2026, though communicated to parliament only weeks later [nu.nl]. Despite a cross-party motion led by GroenLinks–PvdA member Barbara Kathmann calling for non-renewal if Solvinity is acquired by a U.S. entity, the government proceeded citing operational necessity [Biometric Update][Computable].

national security review still pending

The Bureau Toetsing Investeringen (BTI) continues its national security assessment of Kyndryl’s proposed acquisition of Solvinity, delaying definitive policy action [Biometric Update][DutchNews]. The review, conducted under the Ministry of Economic Affairs, examines whether the transaction threatens vital interests related to cybersecurity and data sovereignty [DutchNews]. State Secretary Eric van der Burg deferred final justification until after the parliamentary recess, meaning the formal decision notification arrives after May 6, 2026—the key contractual deadline [Computable][p4sc4l].

internal whistleblower sounds alarm

Pieter van Oordt, former Chief Privacy Officer at Logius, has publicly challenged the integrity of the contracting process [p4sc4l]. He alleges that senior leadership at Logius withheld critical findings from the CISO impact analysis regarding risks to data confidentiality and service availability [Computable]. According to Van Oordt, these omissions misled both the state secretary and parliament, and his attempts to escalate concerns internally were obstructed by Logius director Bert Voorbraak [Computable].

technical dependencies complicate exit

The government asserts that switching providers before August 2026 would jeopardize the stability of DigiD [Tweakers][Nos]. State Secretary Van der Burg emphasized that such a transition constitutes a “long-term project” requiring careful preparation and execution to maintain service continuity [Tweakers][Nos]. While alternatives exist, including the newly established framework with German cloud provider StackIT, no legally binding mechanism allows immediate replacement of Solvinity under current procurement timelines [DutchNews].

data exposure risks under us law

Experts warn that U.S. jurisdiction could allow agencies access to Dutch citizen data hosted by a Kyndryl-owned Solvinity [Biometric Update][p4sc4l]. Provisions like the Clarifying Lawful Overseas Use of Data (CLOUD) Act enable U.S. warrants for data controlled by American firms, regardless of where it is stored [p4sc4l]. Furthermore, geopolitical tensions could lead to service disruptions, as highlighted by Kathmann’s warning that “Trump can shut down our digital government with the single push of a button” [Biometric Update].

political fallout and public distrust

The decision has drawn criticism across much of the political spectrum, excluding JA21 [nu.nl][Biometric Update]. Concerns center on compromised digital sovereignty and weakened oversight capacity [Reddit][p4sc4l]. Civil society groups have mobilized responses, including proposals for collective legal action via Firewall.eu and suggestions for individuals to discontinue DigiD use [Reddit]. Public trust is fragile, with surveys indicating a significant portion of users would abandon DigiD should U.S. ownership finalize [p4sc4l].

Bronnen

contractverlenging digitale veiligheid