Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Iran Conflict 2026
29OCT

Dutch block first US cloud takeover

3 min read
17:49UTC

Dutch minister Willemijn Aerdts prohibited Kyndryl's €100m purchase of Solvinity on 26 May, the first US deal ever blocked under Dutch investment screening, because the firm hosts the country's national digital-identity system.

ConflictDeveloping
Key takeaway

The Netherlands blocked a US cloud takeover with existing screening law, achieving CAIDA's aim before CAIDA exists.

Dutch minister Willemijn Aerdts prohibited Kyndryl's €100m acquisition of cloud provider Solvinity on Tuesday 26 May, citing risk to the public interest⁠1. Kyndryl is a US-listed IT infrastructure firm spun out of IBM; Solvinity is a Dutch provider that hosts DigiD, the national digital-identity system citizens use for tax, healthcare and pensions, along with the MijnOverheid government portal. The decision is the first US deal ever blocked under the Dutch Investment Screening Bureau, the body that reviews foreign investments for national-security and public-interest risk.

The ground was the US CLOUD Act, the 2018 statute (the Clarifying Lawful Overseas Use of Data Act) that lets American authorities compel US-linked companies to disclose data held anywhere in the world. That is the precise argument underpinning CAIDA's public-sector restrictions. The Dutch competition authority ACM (the Authority for Consumers and Markets) had cleared the deal on antitrust grounds in February; investment screening ran on a separate track and reached the opposite conclusion. A Kyndryl spokesperson said the firm was "extremely disappointed"⁠2.

The split outcome shows two regimes testing different questions. Competition law asks whether a deal harms the market; investment screening asks whether foreign control harms the state. The CLOUD Act argument only bites on the second. While CAIDA waited for a College vote, The Hague reached for screening law it already held and reached the result the flagship regulation is still trying to mandate. The precedent is now citable by every member state, including the Berlin government using College silence to blunt the Brussels version.

Deep Analysis

In plain English

Kyndryl is an American IT company that spun out of IBM. It tried to buy Solvinity, a Dutch cloud company that runs the digital-identity system every Dutch person uses to log into government websites for their taxes, doctor and pension. The Dutch government stepped in and said no. The reason was a US law called the CLOUD Act, which lets American authorities demand access to data held by US-owned companies anywhere in the world, including in Europe. The Dutch government decided that having an American firm in control of their national ID system created too much legal risk, even though competition regulators had already approved the deal on separate grounds.

Deep Analysis
Root Causes

GDPR and the US CLOUD Act operate on different jurisdictions with no conflict-of-laws resolution between them. EU data-protection law (GDPR) governs how data may be processed in Europe; the US CLOUD Act governs what American authorities may demand from US-owned processors. These two regimes have no conflict-of-laws resolution mechanism.

A US company operating under both simultaneously cannot fully comply with both when they conflict. The Dutch screening bureau concluded that this structural irresolvability, not any misconduct by Kyndryl, made the public-interest risk unacceptable for national digital-identity infrastructure.

A secondary driver is that DigiD's architecture concentrates access to virtually all Dutch state-to-citizen interactions in a single platform. Tax, healthcare, pensions and government portals share the same credential system. Fragmentation across separate systems would reduce the blast radius of any compelled disclosure, but the Netherlands built efficiency and the current vulnerability in the same architectural choice.

What could happen next?
  • Precedent

    The ruling is the first successful use of EU member-state investment screening to block a US cloud acquisition on CLOUD Act grounds, setting a replicable template across 27 member states.

    Medium term · Assessed
  • Risk

    US trade officials may classify member-state investment screens on CLOUD Act grounds as non-tariff barriers, adding them to the Section 301 dossier already covering DMA cloud probes.

    Short term · Reported
  • Consequence

    European digital-identity infrastructure consolidation via US acquirers is now legally exposed in any member state with an investment screening mechanism modelled on the Dutch bureau.

    Long term · Assessed
First Reported In

Update #7 · Sovereignty arrives, minus Brussels

The Next Web· 3 Jun 2026
Read original →
Causes and effects
This Event
Dutch block first US cloud takeover
A member state used national screening law to do what CAIDA is still waiting to legislate, proving the sovereignty tool already exists outside Brussels.
Different Perspectives
United States (Joint Maritime Information Center)
United States (Joint Maritime Information Center)
The JMIC, the US-led naval reporting cell, rated the Hormuz threat "severe" in its 25 October advisory, as reported by gCaptain, and warned of possible renewed mining. Eight days earlier it found no substantiation for the Guards' mine claims, while US-facilitated transits ran at about 34 a day.
United Kingdom (CPS and Counter Terrorism Policing)
United Kingdom (CPS and Counter Terrorism Policing)
The CPS charged two men under the National Security Act 2023 over the RAF Fairford incident, and Counter Terrorism Policing said it believes the foreign intelligence service involved is Iran's, LBC reported. The case now runs through the courts; both men are charged, not convicted.
Aden and Yemen's recognised government
Aden and Yemen's recognised government
The Houthis told people to leave Aden airport, in the government-held south, before a missile fell there on 28 October, AFP reported, and police reported a second attack that afternoon. The fight between Riyadh and the Houthis is landing on the south's main civilian airport.
Qatar (mediators)
Qatar (mediators)
Qatar-led mediators put new terms to Iran this week, which an Iranian official called "ideas, not a proposal". Riyadh framed the Tehran meeting as support for Qatari and Pakistani mediation, keeping Doha at the centre of the indirect channel.
Korea Shipowners' Association
Korea Shipowners' Association
The association said the ships Iran listed were sub-chartered to an overseas oil company, not owned by Sinokor, carried no South Korean crew, and that Sinokor was unaware of the warning. South Korea's shipowners are contesting whose vessels the notice covers before it takes effect.
Kuwait (foreign ministry)
Kuwait (foreign ministry)
Kuwait summoned Iran's ambassador, Mohammad Toutounji, and handed him a protest note over the embassy's denial that its citizen took part in the alleged plot against Interior Minister Fahad Al-Yousef. Kuwait is answering through its courts and a diplomatic protest, citing international law and the UN Charter.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.