The only way to stop the Dutch government’s DigID digital identity system from falling into American hands is through intervention by the regulator currently assessing the planned takeover, MPs were told on Wednesday.

The Bureau Toetsing Investeringen, or investment check office, is examining the takeover of cloud company Solvinity by US-based Kyndryl to determine whether there are implications for national security.

The DigID identity system is used to access services including the tax office, local authority services, health insurance and pension funds. Solvinity also provides secure cloud and data services to a range of government clients, including the MijnOverheid portal and the ministry of justice.

Once the investigation has been completed in several months’ time, BTI officials will make recommendations to the minister for economic affairs who will then decide whether the takeover should go ahead.

“My fears about this have increased rather than been reduced by your explanation,” Silvio Erkens of the VVD said after a presentation by BTI officials and other experts.

The ministries involved are working with both companies to introduce “mitigating measures”, but under the US Cloud Act, cloud service providers can be legally required to make information available to the US government, even if the data are stored in Europe.

“This sounds like a false sense of security,” Henk Vermeer of the BBB said. “There is an enormous risk, for our taxes as well, because we are fully dependent on this system.”

The DigID contract with Solvinity runs until August 2028.

Earlier this month, a group of experts warned that “handing over part of our vital infrastructure to the United States increases Dutch vulnerability to blackouts, manipulation or even blackmail.”