THE HAGUE — The Dutch government has blocked the American IT company Kyndryl from buying Solvinity, the cloud provider that hosts the digital identity system Dutch life runs on, in a veto that converts Europe’s deepening distrust of Washington’s reach over American technology firms into administrative fact.
Willemijn Aerts, the junior minister for the digital economy, imposed what the government’s decision letter calls a complete prohibition on the acquisition, citing risk to the public interest, TechCrunch reported. The decision, formalized in a letter published this week, ends a deal valued at roughly $115 million that Solvinity’s owner, the British private equity firm Vitruvian Partners, agreed with Kyndryl in November.
What Solvinity sells is not exotic: hosting. What it hosts is the point. The company operates the platform behind DigiD, the secure login that millions of Dutch citizens use to reach the tax office, pension funds, health insurers and local councils, the single key to the country’s administrative life, DutchNews reported. Whoever owns the host sits within reach of the data, and under American law, whoever owns the host can be reached by Washington.
That law is the heart of the veto. The US CLOUD Act empowers American authorities to compel US-owned companies to hand over data they store anywhere in the world, regardless of the data protection laws of the country where the servers stand. Dutch members of parliament and security experts warned that selling Solvinity to an American owner would place the private records of Dutch citizens within that jurisdiction, and the government’s screening agency for foreign investments reached the same conclusion in its national security assessment.
The procedural details sharpen the message. The Dutch competition regulator had already cleared the sale on market grounds, and the government extended Solvinity’s DigiD contract in May while the security review ran. Aerts described the screening as country-neutral, risk-based and proportionate, language constructed to say that the Netherlands did not single out the United States, while the substance of the decision said precisely that an American buyer was the risk. Kyndryl, the IBM-spinoff infrastructure giant, said it was extremely disappointed and complained that the politicisation of this process has overshadowed the clear and important benefits this transaction would have brought to Solvinity’s customers and Dutch citizens.
A year ago the veto might have read as bureaucratic caution. In 2026 it reads as policy. European governments have spent the year concluding that dependence on American technology is a vulnerability rather than a convenience, as the Trump administration converts every economic relationship into leverage, and the conclusion is no longer confined to speeches about sovereignty. It now blocks transactions.
The Dutch case lands in a season of governments reclaiming their digital perimeters. As The Eastern Herald reported, India froze Starlink’s final clearances over the system’s use in the Iran war, and Canada moved to regulate the platforms Washington champions. The common thread is that American technology arrives attached to American power, and states on every continent are repricing the attachment.
For Washington the irony is self-inflicted. The CLOUD Act was written to give American law enforcement reach into data abroad; its practical effect in The Hague was to make an American company unbuyable. Every statute that extends US jurisdiction through US firms now functions, in foreign capitals, as a disclosure label: ownership by this company includes exposure to this government.
For the European technology sector, the veto is an industrial policy delivered by other means. If American buyers cannot acquire the infrastructure that touches government data, that infrastructure stays European, gains a protected market, and accumulates precisely the sovereign-cloud credentials that Brussels has been trying to conjure with subsidies. The prohibition does quietly what years of digital sovereignty communiques could not.
None of this required an accusation. The Netherlands did not claim Kyndryl mishandled anything; it observed that the company is American and that American law follows American companies abroad, and it acted on the observation. That is what makes the decision portable: every European government with a sensitive system hosted by a potential American acquisition target can now cite the Dutch precedent, and the list of such systems is the list of how modern states function.
The deal is dead, the data stays where it was, and the letter that killed it will be read in more capitals than The Hague. The era when American ownership of European infrastructure was a neutral fact ended somewhere between the trade wars and the data demands, and the Dutch have now put the date on paper.
