ⒾMachine translations by Deepl
Solvinity (DigiD)
In November 2025, it was announced that Dutch DigiD provider Solvinity would be acquired by US tech company Kyndryl. Under US law, this would put the Dutch vital infrastructure behind DigiD within reach of the US government, giving access to sensitive personal data of the entire Dutch population. Therefore, in January 2026, the new Firewall foundation, together with a group of scientists, journalists, opinion makers and Privacy First, filed a request with the Dutch Investment Screening Bureau (Bureau Toetsing Investeringen, BTI) and the responsible Minister of Economic Affairs to stop the acquisition of Solvinity by Kyndryl and be recognised as interested parties, followed by a lawsuit about this at the Rotterdam District Court.
Initially, there was no response from the Investment Assessment Bureau or the Minister. In early March 2026, our coalition’s lawyers therefore served the Minister with a notice of default. No response was forthcoming to this either, and in response, the coalition lodged an administrative appeal with the District Court of The Hague at the end of March. In April, the District Court of The Hague announced that our appeal had been referred to the District Court of Rotterdam. We subsequently filed a new application for interim relief there as well. Our coalition felt supported in this by the fact that political and public opposition to an American takeover of Solvinity had by then taken on massive proportions across all sections of Dutch society. In May 2026, our court hearing at the Rotterdam District Court. A week later, there was a positive breakthrough: the takeover of Solvinity by Kyndryl was approved by the State Secretary for Economic Affairs banned. This is to safeguard the public interest (privacy and national security).
Following the acquisition ban, the Firewall Foundation and Privacy First et al. subsequently decided to withdraw our ongoing legal proceedings before the Rotterdam District Court; this was due to the resulting lack of a current legal interest. However, Solvinity subsequently decided to challenge the acquisition ban in court. To this end, Solvinity (together with the Luxembourg-based company Host Lux) had lodged an objection with the State Secretary and submitted an application for interim relief to the Rotterdam District Court. The court hearing in that case took place in July 2026 and was partly open to the public. At the court’s invitation, the Firewall Foundation, Privacy First and the Human Rights in Finance Foundation participated in this hearing as third parties. A week later, the critical judgment: the court ruled against Solvinity and upheld the ban on the takeover. It was notable in this regard that the State Secretary was ordered to pay all the costs of the proceedings; this was due to the previous obstruction by the State Secretary and/or the Crown Counsel regarding the three foundations’ participation in and (partial) access to the case documents.
According to Privacy First, the takeover ban is the only right decision the Dutch government could have made. Any other outcome would, in our view, have been irresponsible and unlawful. Privacy First hopes that this decision sets a precedent to also take a critical look at the use of other services from outside Europe. This could represent a positive turning point in history.
In addition to the Firewall Foundation and Privacy First, our coalition comprised the initiator Eric Smit, Esther van Egerschot, Maxim Februari, Felienne Hermans, Bert Hubert, Joris Luyendijk, Caroline Nevejan, Reijer Passchier, Jelle Postma, Sander Schimmelpenninck, Karin Spaink, Marleen Stikker and Kees Verhoeven. This case was handled on a pro bono basis by Roland Mans (Corten De Geer Advocaten) and Matthijs Kaaks (Boekx Advocaten).
The Firewall Foundation and Privacy First will continue to monitor developments closely and will intervene again if necessary.
