Reliance on US tech puts vital services at risk, Dutch regulator says

The Dutch privacy and data protection authority (DPA) has voiced concerns about the digital autonomy and sovereignty of the Netherlands. Like other organizations and advocacy groups, the privacy regulator is recommending that the government act and take robust measures.

“In recent years, the Netherlands has become heavily dependent on a limited number of large foreign cloud and IT service providers for its vital processes. This dependence, combined with rapidly changing geopolitical relations, means that the Dutch data protection authority (AP) has no choice but to share its serious concerns about the continuity of vital processes in the Netherlands with you,” the privacy regulator writes in a letter that’s addressed to the Ministry of Economic Affairs.

The AP is referring to the country’s critical infrastructure: failure, disruption, or manipulation of vital processes can lead to major social disruption. The privacy regulator has previously called on the government to better protect its critical infrastructure, but with little to no avail.

According to the Dutch DPA, vital processes across the board have become far too vulnerable to prevent large-scale and prolonged unavailability.

“In such a situation, the Netherlands could come to a standstill, resulting in incalculable and possibly irreparable social, economic, and above all personal damage,” the AP warns.

It therefore calls on the government to take additional measures with the utmost urgency to promote digital sovereignty and mitigate the risks for the critical infrastructure.

For starters, the AP recommends that the government join the EU Cloud Sovereignty Framework, which can be used to assess the tendering of cloud services and reduce IT dependence on non-European cloud providers.

Additionally, there are insufficient options to terminate contracts when an IT supplier is acquired by a non-European firm. To prevent the personal data of European citizens from being inadequately protected, the privacy regulator advises the government to formulate a clear exit strategy for IT agreements.

Recently, American IT service provider Kyndryl announced its interest in acquiring Solvinity, which is the supplier of DigiD, an application that allows Dutch authorities to verify someone’s identity online. This proposed acquisition has raised concerns with privacy experts and politicians. Currently, extensive research is being conducted into the possible consequences for DigiD’s services, security, and privacy.

Furthermore, the government should proactively monitor the IT market to anticipate developments that pose risks to the continuity of vital processes at an early stage.

According to the AP, organizations within the government are too free to interpret their cloud policies as they see fit. “These differences can harm risk management for cloud services because they are not sufficiently well-known. A uniform approach can help mitigate this,” the regulator recommends.

Lastly, the government should invest more resources into European alternatives to reduce its dependence on American tech companies.

Unlock more exclusive Cybernews content on YouTube.