The Netherlands’ DigiD, a mobile-accessible national identity system used by 16.5 million residents to log in to government services from their phones, is at the center of a parliamentary standoff over foreign ownership of the infrastructure that processes mobile authentication requests.
The Tweede Kamer has passed a motion calling on the government to remove DigiD from hosting provider Solvinity before a planned acquisition by U.S. firm Kyndryl takes effect. The motion, tabled by GroenLinks-PvdA and supported by all parties except JA21, instructs the cabinet to either find a Dutch alternative for DigiD hosting or block the deal entirely. Lawmakers cited the U.S. Cloud Act, which can compel American-owned companies to hand over data to U.S. authorities regardless of server location, as a direct threat to the integrity of mobile identity authentication for Dutch citizens.
DigiD serves as the primary digital credential for residents accessing tax filings, healthcare portals, and municipal services, including through the DigiD mobile app. Solvinity hosts the infrastructure that processes these authentication requests. Kyndryl, a former IBM subsidiary focused on IT infrastructure services, received approval from the Dutch competition regulator ACM in February to acquire Solvinity, despite objections from multiple parliamentary factions who argued the review failed to account for national security dimensions.
Pieter van Oordt, senior privacy advisor at Logius, the government agency that manages DigiD, has emerged as a whistleblower in the dispute. Van Oordt revealed that an internal risk analysis concluded existing safeguards would be insufficient to protect Dutch citizen data under American ownership, and said the full analysis was never shared with parliament.
Junior home affairs minister Eric van der Burg told lawmakers the existing contract cannot be broken immediately and that the government is awaiting guidance from the Bureau Toetsing Investeringen, the national investment screening body assessing the deal’s security implications. Despite the parliamentary vote, Van der Burg authorized Logius to extend its contract with Solvinity on 27 March, with formal signing expected in early May.
The dispute underscores a growing challenge for mobile identity systems worldwide: as governments shift authentication to smartphone apps, the question of who owns and operates the backend infrastructure becomes a matter of digital sovereignty.
Sources: NL Times, DutchNews.nl, DutchNews.nl
–
By the Mobile ID World Editorial Team
