The Dutch government has extended the contract with cloud firm Solvinity to run its online access portal DigiD despite widespread concerns about an impending takeover by a US buyer.
Junior home affairs minister Eric van der Burg confirmed that he had signed off the extension to protect “the continuity and security of Logius’ services”, referring to the government-owned company that owns DigiD.
Solvinity, a Dutch-based IT services company, operates the hosting platform for DigiD, which is used in the Netherlands as a secure gateway to access confidential records online. Millions of people use DigiD to communicate with the tax office, pension providers, health insurers and local councils.
American IT firm Kyndryl is in advanced stages of talks to acquire Solvinity, leading to fears that the firm could be required to share private information with the US government. Under the US Cloud Act, American-owned companies can be required to hand over data to US authorities even when the servers are in Europe.
Van der Burg said in a written answer to MPs that he authorised Logius to extend the contract on March 27, before parliament passed a motion last week calling for the cabinet to find an alternative buyer if the sale to Kyndryl goes ahead.
The minister said the contract signing would take place in early May, ahead of a May 6 deadline.
Trump concerns
Barbara Kathmann, the GroenLinks-PvdA MP who sponsored the motion, has said a Dutch buyer is waiting in the wings to take over the management of DigiD services from Solviity.
Kathmann has warned that the deal would give the Trump administration the power to “turn off our digital government with one flick of the switch”.
Logius has said in official statements it will remain a Dutch-based company and Solvinity did not have access to individuals’ income details or medical records.
But Pieter van Oordt, the company’s chief privacy officer, told MPs that an internal security analysis had concluded that its risk mitigation measures could not fully protect it from the impact of the Cloud Act.
Van der Burg’s decision was also taken before the conclusion of an analysis by the investment screening body BTI into whether national security would be compromised by the takeover. The national security screening is seen as the only mechanism that could block Kyndryl’s acquisition of Solvinity at this late stage.
The competition regulator ACM has cleared the takeover, but stressed it had no remit to consider the security implications. Economic affairs minister Heleen Herbert will take the final decision on whether to approve it.
