Court upholds ban on US takeover of DigiD provider Solvinity
In November 2025, it was announced that the Dutch DigiD provider Solvinity was to be acquired by the US tech company Kyndryl. Under US law, this would have brought the Dutch critical infrastructure underpinning DigiD (and with it, sensitive personal data of the entire Dutch population) within the reach of the US government. This takeover was subsequently, and rightly so, blocked by the State Secretary for Economic Affairs. In a court case brought by Solvinity against this takeover ban – in which organisations including The Firewall and Privacy First intervened – the Rotterdam District Court ruled today that the takeover ban must remain in place for the time being.
As early as January 2026, the new foundation, The Firewall, together with a group of scientists, journalists, opinion leaders and Privacy First, had a request submitted to the Investment Assessment Bureau (BTI) and the Minister for Economic Affairs responsible, with a view to halting Kyndryl’s takeover of Solvinity and being recognised as interested parties. However, there was initially no response from the Investment Assessment Board or the minister. In early March, our coalition’s lawyers therefore served a notice of default on the minister. There was still no response to this either, and the coalition subsequently lodged an administrative appeal against this profession at the Rotterdam District Court. Our coalition drew strength from the fact that political and public opposition to an American takeover of Solvinity had by then grown to massive proportions across all sections of Dutch society. In May, our first court hearing at the Rotterdam District Court. A week later, there was a positive breakthrough: the takeover of Solvinity by Kyndryl was approved by the State Secretary for Economic Affairs banned. This is to safeguard the public interest (privacy and national security).
Solvinity subsequently decided to challenge the acquisition ban in court. To this end, Solvinity (together with the Luxembourg-based company Host Lux) had lodged an objection with the State Secretary and submitted an application for interim relief to the District Court of Rotterdam. The court hearing in that case took place last week and was partly open to the public. At the court’s invitation, the Firewall Foundation, Privacy First and the Human Rights in Finance Foundation participated in this hearing as third parties. Today, the critical judgment: the court has ruled against Solvinity and is upholding the ban on the takeover for the time being. The judge recognises the legal basis for the ban and rules, amongst other things, that “the takeover of Solvinity by Kyndryl could pose a threat to the public interest”, in line with the positions of the State Secretary, Firewall and Privacy First et al. The judge ruled as follows on this matter:
“Solvinity has extensive access to a great deal of (largely highly) confidential government information, including (special) personal data and sensitive information from the criminal justice system and the judiciary. There is a risk that this information could be requested by Kyndryl Nederland’s parent company due to the applicability of US extraterritorial legislation. The State Secretary has deemed Kyndryl’s ability and willingness to oppose this to be insufficient to eliminate the risk, particularly given that Kyndryl may be ordered by the US government to keep its information requests entirely confidential. Even if that risk may be limited in practice, the State Secretary was able to take the view that even a limited risk is unacceptable given the significant consequences that the realisation of even a limited risk could have for the public interest.” (line 47)
What is striking about the judgment is that the State Secretary is nevertheless ordered to pay all the costs of the proceedings; this is due to the earlier obstruction by the State Secretary and/or the Crown Solicitor regarding the three foundations“ participation in and (partial) access to the case documents. The judge describes the State Secretary’s conduct in the proceedings as ”inconsistent with the rule of law” (see paragraph 33).
No appeal may be lodged against this interim judgment. A parallel appeal procedure brought by Solvinity is still ongoing; Firewall, Privacy First and Human Rights in Finance also wish to intervene as third parties in that procedure.
According to Privacy First, the takeover ban is the only right decision the Dutch government could have made. Any other outcome would, in our view, have been irresponsible and unlawful. Privacy First hopes that this decision sets a precedent to also take a critical look at the use of other services from outside Europe. This could represent a positive turning point in history.
In addition to the Firewall Foundation and Privacy First, our coalition comprised the initiator Eric Smit, Esther van Egerschot, Maxim Februari, Felienne Hermans, Bert Hubert, Joris Luyendijk, Caroline Nevejan, Reijer Passchier, Jelle Postma, Sander Schimmelpenninck, Karin Spaink, Marleen Stikker and Kees Verhoeven. This case was (and is) being handled by Roland Mans (Corten De Geer Advocaten) and Matthijs Kaaks (Boekx Advocaten).
Read here the full judgment on rechtspraak.nl.
Will you support us in this matter? Why not become a donor?