US tech firm drops takeover bid for DigiD operator Solvinity

The American IT services company Kyndryl has abandoned its attempt to buy Solvinity, the Amsterdam-based firm that runs the hosting platform behind DigiD, ending a takeover the Dutch government blocked in May on national security grounds.

A company spokesperson told the NRC that Kyndryl no longer wants to acquire Solvinity. The company’s latest quarterly report to US regulators also noted that the €100 million deal had been prohibited and that Solvinity’s owners were weighing their response.

DigiD is the login that millions of people in the Netherlands use to file tax returns and reach health insurers, pension funds and local councils. Solvinity runs the platform it sits on, along with the Berichtenbox message service in the MijnOverheid portal, and also supplies the justice ministry.

Security concerns
The takeover, announced last November, alarmed MPs and security experts because it would have brought the data behind DigiD within reach of the US Cloud Act, which can compel American-owned companies to hand over information even when it is held on servers in Europe.”

Junior digital economy minister Willemijn Aerdts blocked the sale in late May “to protect the public interest”, acting on advice from the BTI, the agency that vets foreign investments for security risks.

What happens next
Solvinity, owned by the British private equity firm Vitruvian Partners, is appealing. A Rotterdam judge refused to suspend the ban in July but told Aerdts to weigh a lighter measure than an outright ban.

Aerdts is due to rule on the company’s objection by the end of September. Solvinity and its owners are “exploring remedies, including contesting the government’s decision”, according to Kyndryl’s filing, and may also pursue a claim against Kyndryl.

The current DigiD contract runs until August 2028. The government has said the successor contract will be tendered under defence and security procurement rules that let it exclude bidders from countries whose laws could force access to Dutch data – meaning the platform’s next operator will have to be European.