According to reports from Dutch media Vrij Nederland and NL Times, Microsoft has been accused of submitting emails, meeting minutes, and invitations from civil servants of two Dutch regulatory bodies—the Authority for Consumers and Markets (ACM) and the Dutch Data Protection Authority (AP)—to the US House of Representatives without any anonymization. The civil servants involved were all working on the enforcement of the EU’s Digital Services Act (DSA), which requires platforms such as Facebook and TikTok to take stricter measures against illegal content and disinformation; the US government has characterized this regulation as “censorship.” Dutch State Secretary for Digital Economy and Sovereignty Willemijn Aerdts has raised the matter with US Ambassador to the Netherlands Joe Popolo, stating that “if there is a dispute, it should be resolved with us or at the European level, not by pitting civil servants against each other.” Another State Secretary, Eric van der Burg, called the situation “worrying” and demanded that Microsoft clarify exactly which documents were submitted.
The legal backdrop of this case is the US CLOUD Act, which requires US technology companies to provide data upon government request, regardless of where the data is stored, and without prior notification to the government of the country where the data resides. Following the exposure of this incident, the issue of European digital sovereignty has once again come into focus—the Dutch government itself still relies heavily on US cloud services such as Microsoft 365 for government affairs. This controversy echoes the Netherlands’ recent decision to block a US company from acquiring Solvinity, a key digital identity infrastructure provider, further accelerating discussions among European countries about reassessing their government cloud service procurement strategies.