The takeover of the cloud service used by the Dutch government’s Digid personal identification system will leave sensitive information in US hands, according to a senior official with the home affairs ministry’s digital service agency, Logius.

The agency’s most senior privacy advisor, Pieter van Oordt, has told the Volkskrant that “detailed information about everyone in the Netherlands” threatens to fall into US hands and that the US could also block access to the system.

Economic affairs minister Heleen Herbert is currently deciding whether or not to give the green light to the takeover of cloud service provider Solvinity by Kyndryl which was announced late last year.

“I cannot put it any more simply,” Van Oordt told the paper. “The US would be able to switch off the Digid system for a long time and issue secret information requests.”

If the takeover is approved, the Digid and MijnOverheid systems will fall under US law, which means the US security services could access them via the Cloud Act and the Foreign Intelligence Surveillance Act (FISA).

Van Oordt said his warnings about the risks have fallen on deaf ears and that he has not been able to get access to the junior home affairs minister who is in charge of digital security. He told the paper he saw no alternative but to go public about his concerns.

The Digid system is used by hospitals, pension funds, prison service, and the legal system, as well as government departments. The information it holds includes addresses, family composition, car number plates, debts, social security entitlements and more.

The Dutch competition body ACM, which has also assessed the takeover, has said it sees no objections to the takeover on competition grounds.

Spokesmen for the home affairs and economic affairs ministries told the Volkskrant that there is “nothing new” to say about the approval process at the moment.

European cloud service

The takeover comes as governments and institutions across Europe seek to reduce their reliance on US cloud providers such as Amazon, Google and Microsoft.

In addition, MPs are virtually united behind the call to ensure the servers, storage and security for the Digid system and other government departments should remain in Dutch, or at least European, hands.

In January, a group of experts also warned that “handing over part of our vital infrastructure to the United States increases Dutch vulnerability to blackouts, manipulation or even blackmail.”