On 25 May 2026, the Dutch State Secretary for the Digital Economy and Sovereignty, Willemijn Aerdts, issued a complete prohibition on US firm Kyndryl's roughly €100m acquisition of Solvinity, the cloud host that runs DigiD, MijnOverheid and Digipoort. The decision, taken on the advice of the Bureau Toetsing Investeringen (the Investment Screening Bureau, or ISB) and notified to parliament on 26 May, rests on Article 14a.4 of the Telecommunications Act — the screening regime introduced by the Act on Undesirable Control of Telecommunications. It is the first acquisition the bureau has ever blocked since it began operating in 2020, and it lands despite the Dutch competition authority, the ACM, having cleared the deal on antitrust grounds back in February 2026.
The strongest case for the block
Start with the steelman, because it is genuinely strong. DigiD is the single front door to Dutch public life: tens of millions of authentications a year for tax, healthcare, pensions and benefits. The concern is not hypothetical politics but a specific legal mechanism — the US CLOUD Act of 2018, which can compel a US-headquartered provider to produce data within its "possession, custody, or control" even when that data sits on servers in the Netherlands. A national identity backbone is exactly the kind of asset where a state cannot tolerate a foreign jurisdiction holding a latent legal claim over the operator. Privacy First, the Dutch civil-liberties foundation, called the prohibition the only lawful outcome. On the narrow question of whether the risk is real, the government and its critics-from-the-left are right: it is.
A real risk, met with a blunt instrument
The problem is not the diagnosis but the remedy. A complete prohibition is the most severe tool in the screening toolbox, and the regime is built precisely so that it need not be the first one reached for. Chapter 14a of the Telecommunications Act, like the broader Vifo investment-screening framework the ISB also administers, allows conditional approvals: security agreements, ring-fencing of sensitive data, local-personnel and local-control requirements, data-localisation mandates, board-level golden shares, and continuity guarantees. These are not exotic. The US itself rarely blocks deals outright; CFIUS resolves the large majority of national-security concerns through mitigation agreements rather than outright bans. The UK's National Security and Investment Act, France's screening regime and Germany's all lean on conditions first, prohibition last.
Nothing on the public record explains why DigiD's continuity and the CLOUD Act exposure could not have been neutralised by binding conditions — a Dutch-incorporated, independently governed operating entity for the Logius platform, with the sensitive workloads contractually walled off from US legal reach. The government has not said, because it cannot: the reasons are classified, offered to MPs only in a confidential technical briefing. That opacity is the second cost. Foreign investors now know the Netherlands can reverse a cleared, year-old transaction at the final step for reasons they will never see, with no published proportionality analysis weighing prohibition against the lighter alternatives the statute expressly provides.
The sovereignty paradox
There is an awkward symmetry here that the Dutch debate has mostly ignored. Since 2023, the Netherlands has restricted ASML — its own most valuable company — from exporting the most advanced lithography systems to China, largely in alignment with US strategic priorities. In the Solvinity case it invokes sovereignty to push a US firm away. The throughline is that "digital sovereignty" has become an instrument that cuts in whatever direction the moment demands, and that elasticity is the danger. Aerdts herself wrote that the Netherlands "attaches great value" to the presence of American technology companies and their contribution to Dutch infrastructure — yet offered no public reasoning for why this particular contribution had to be refused entirely rather than fenced. A sovereignty policy that cannot articulate its own limits is not a policy; it is a discretion.
The dependency the block does not fix
Blocking one acquisition does nothing about the structural fact underneath it. AWS, Microsoft Azure and Google Cloud together control more than half of Europe's cloud market; Dutch ministries, hospitals and universities run on US hyperscalers every day, CLOUD Act and all. Keeping Solvinity in Dutch hands secures the operator of DigiD's platform, but the data and dependencies flowing through European public IT remain overwhelmingly American. Sovereignty bought one company at a time, by veto, is the most expensive and least durable kind. The durable version is supply-side: credible sovereign and EU cloud capacity, open standards and portability so workloads can move, and procurement that rewards them. That is industrial policy and market-building — slow, costly, and far more effective than a screening veto that leaves the 90% untouched while signalling unpredictability to the investors Europe still needs.
What proportionate looks like
None of this argues for waving critical-infrastructure deals through. It argues for proportionality as the operating principle: screen rigorously, demand conditions that genuinely neutralise the identified risk, and reserve outright prohibition for cases where no condition can. Publish a reasoned proportionality assessment, even in redacted form, so the bar is legible to the next investor. The Dutch instinct to protect DigiD is sound. The instinct to reach for the heaviest instrument first, behind a classified rationale, is the part that should worry anyone who wants Europe to stay both secure and open for investment.